CVE-2018-1000613: Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including...

Security readout for executives and security teams

Some Java applications using Bouncy Castle 1.58 or 1.59 could run unexpected code when processing a malicious XMSS or XMSS^MT private key. The issue is serious where applications import private keys from users or external systems, but the sources do not show broad active exploitation. Exposure is most likely in Java applications or bundled products using Bouncy Castle 1.58 or 1.59 and accepting externally supplied XMSS/XMSS^MT private keys. Transitive dependency exposure is possible through vendor products listed in advisories. Prioritize remediation where Java services handle externally supplied private keys or rely on affected vendor products. For internal-only systems without XMSS/XMSS^MT key import paths, treat as dependency hygiene with targeted validation. Mitigation focus: Upgrade Bouncy Castle Java Cryptography APIs to version 1.60 or later.; Apply vendor updates for affected Oracle, NetApp, openSUSE, or downstream products.; Avoid deserializing externally supplied XMSS/XMSS^MT private keys until patched..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.