[dependabot]

Bumps bouncycastle from 1.86 to 1.87.
Updates org.bouncycastle:bcprov-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

• PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
• X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
• Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
• CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
• The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
• KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
• ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
• The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
• DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
• TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
• TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
• CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
• OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
• OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
• The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
• The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
• OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
• OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
• OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
• OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
• OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
• OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
• OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
• OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
• OERInputStream.uint64() read its value as signed; it now reads unsigned.
• The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
• The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
• ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
• A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
• The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
• A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
• Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
• A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
• A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
• The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
• Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
• SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
• The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
• Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
• ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
• ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
• Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
• The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

• See full diff in compare view

Updates org.bouncycastle:bcpkix-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

• PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
• X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
• Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
• CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
• The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
• KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
• ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
• The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
• DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
• TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
• TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
• CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
• OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
• OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
• The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
• The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
• OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
• OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
• OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
• OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
• OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
• OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
• OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
• OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
• OERInputStream.uint64() read its value as signed; it now reads unsigned.
• The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
• The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
• ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
• A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
• The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
• A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
• Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
• A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
• A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
• The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
• Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
• SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
• The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
• Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
• ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
• ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
• Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
• The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)