CVE-2026-13586

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13586
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13586.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-13586
Downstream
Related
Published
2026-08-03T02:58:00.982Z
Modified
2026-08-14T18:56:40.501274590Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
Details

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13586.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.2.7"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.2"
                },
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.1.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "bcorg"
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57fbd3c501f7a369f64eda311d6a709fc0bcae84
Fixed
75d60dfb4ca72bea6da96234138bc9b1556ef5b0
Fixed
fa59cc23502f73def89d94374540cc92af647b96
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.85"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/bcgit/bc-lts-java
Events
Introduced
468b5082f3f0971e80bf9edb7029c17b39b9ba0c
Fixed
f101b232c5d3e07ecdd504210a57e43831d6cd65
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.73.0"
        },
        {
            "fixed": "2.73.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
r1rv73
r1rv74
r1rv75
r1rv76
r1rv77
r1rv78
r1rv80
r1rv81
r1rv82
r1rv83
r1rv84
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9

Database specific

vanir_signatures 
[
    {
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "wrapKey"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "260422492601392403562186346117797932263",
            "length": 546.0
        },
        "signature_version": "v1",
        "id": "CVE-2026-13586-002188ea",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "pkix/src/test/java/org/bouncycastle/pkcs/test/AllTests.java"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "79946982070285445374146250650913377811",
                "179650968490506108345729476789349654949",
                "145458289212498206683604737907471121625",
                "64539651368602189613995280308136960006"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2026-13586-0b8838d2",
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "41001149971566920926172422598611415487",
                "190390693420381772366899824561155703678",
                "98845164067063405772417991984847345528",
                "298433849928867912908642892087896757851",
                "288796012701121643534871550001087026019",
                "46689199092432997951304373066538356092",
                "89654090213433072731233499193242700974",
                "312861514196008427953606718599410302641",
                "197698069387627634985875492644896959315",
                "70564933956531417971950257563964483679",
                "96053171010948502306421932903622191833",
                "126629371974147410272569159588625389849",
                "174199159503475410460053114325234450962",
                "159536111004758318032223378320539176439",
                "321624950595252441607362734170894228799"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"
        },
        "id": "CVE-2026-13586-18b86019",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Line"
    },
    {
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java",
            "function": "convertToDefiniteLength"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "286055730897453174432320262728240234611",
            "length": 930.0
        },
        "id": "CVE-2026-13586-21147fa9",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-2493261f",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java",
            "function": "validateIterationCount"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "digest": {
            "function_hash": "58365957664759198879275180690962078769",
            "length": 516.0
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "57781819148775813988960117581989844656",
                "58036982787995010768157555839774516389",
                "57678703734170259786133521115930766716",
                "41327067346447060560149062605282196159",
                "117738975282177731720183743564240100192",
                "86230013864835074102610615668165724476",
                "291685336211696785872641138446001029103",
                "143034907817536538742623279666141777718"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PKCS12StoreTest.java"
        },
        "deprecated": false,
        "id": "CVE-2026-13586-2d3244b5",
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13586-33920d51",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PKCS12StoreTest.java",
            "function": "testIterationCount"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "digest": {
            "function_hash": "172792747652889504919481677741929593238",
            "length": 463.0
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "130717456779628290799319971052627511767",
                "322418715518905224148143360855442719421",
                "111086614440389160754349079363144958334",
                "251860252208781725316875861082912946993",
                "64275336164675590167317642411364081752",
                "14660861311978991637606164755265419658"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2026-13586-39a26c47",
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13586-40e82781",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "digest": {
            "line_hashes": [
                "151179342390068528947256326612171572473",
                "293795048864860963425209777415703147505",
                "115147192350017007440785523846095472198",
                "179554346487941832942413908254307429952",
                "279271448171997901545391798711431608408",
                "240090870655493558604203554986123636543",
                "143523729449738210447622070784428507092",
                "79755429581127719180493161911797512773",
                "92095536127134500494031048208547605929",
                "264131394820676579787227694404821935169",
                "154370900486336087229587842721143970450"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line"
    },
    {
        "digest": {
            "function_hash": "60233060954462720211381643716690262486",
            "length": 1131.0
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "unwrapKey"
        },
        "deprecated": false,
        "id": "CVE-2026-13586-51a1461d",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "digest": {
            "line_hashes": [
                "15650509136633268867029493405596642247",
                "227534459320179647701683873883803837304",
                "71179469984323401089659484245823125068",
                "229227395035598765600064513616912218319",
                "306029829301017755223220592868683344196",
                "204527920320668335291236870675500326260",
                "78256143013997344661556856569173490409",
                "23335947030539593210977585011008101248",
                "37458143115277431710122611788528433915"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"
        },
        "deprecated": false,
        "id": "CVE-2026-13586-6235e0ac",
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13586-6cdc258c",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "cryptData"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "159690551868197960726744589442781624402",
            "length": 1082.0
        },
        "signature_type": "Function"
    },
    {
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "186267376115903364161411840572558251985",
                "186614312106326646816920241465895542631",
                "221120964458291626795167932479908211293",
                "275830356417188533252641407657651788768",
                "270218167468528634434691442713138391775",
                "198940029424508078572440411175544479467",
                "100592550277153479900560485041465773254",
                "107553554929838010740298771409195753299",
                "203338385865972582371335440685867743462",
                "128086724510568589507423273138909535729",
                "119333703086741099737182090765603630466",
                "93973905555515000199249510521519565321",
                "208396192308354091077788005293890669977",
                "311772047338465315272424520962557666664",
                "327124414811670576514194755936746409171",
                "257048045848677049050505552714157391068",
                "49254691501117575229969552818390783668",
                "119771261517632398768694931105263379870",
                "317927588361279682485634066879971875636",
                "295819596676669900034606820134177073093",
                "205321377526250594047484323124337500842",
                "123308104456545247788180282490936508122",
                "231186937069744724619693748173531300428",
                "289720173910302058970332420600698664011",
                "295014962174494862872642169295092346607",
                "303783603005723667043485208396720639642",
                "211265271394268614071701412810252427378",
                "77053077633367560711092385240446794401",
                "190393130149868586934603915656788167379",
                "309140075013886866363850966866134934721",
                "175181431784148470477459107558890167204",
                "330243716742639974347751739972842759667",
                "294217964546357093081160642003885324840",
                "266044547332714625868079852680276147431",
                "67354180704815360213628625979449937085",
                "175692723456558492451769326069653613131",
                "191689455484828277718995307378487462058",
                "308794137792613564776022329912718381768",
                "242175138703892252163742447061410442056",
                "230174568875680997735658060246143321759",
                "330837984345337234066173445908700981695",
                "177847441051607181338372963963312370839",
                "197978004139751473205214522304045275430",
                "79832297816223048015604016824572237095",
                "320077132895002814259988282438781302511",
                "103020380501349872512924345579020806624",
                "69018421287854072595061998164338807947",
                "236547675343145943181538354309409111099",
                "127111734054559714967648608900847403015",
                "211601684207564780056580125922272999520",
                "42318915853577061003633144088761641246",
                "303597983800682589197997361011603778284",
                "13110806998893626838480489771906972101",
                "150543915750858159598496691852742417315",
                "205605652308111586549537427977721999130",
                "100319644078267214837368760618091605546",
                "316608026583348886568770007000726371718",
                "127867363184847686115953433324652442023",
                "143169495143164690536758284726745117664",
                "155018470219325109631894984771889241634",
                "138163910965300236136401161206903735542",
                "141800620852228603329831116705821511922",
                "209567004073084408918386233892666789465",
                "24638869168397144488517348989416597460",
                "258270239185139516247935102615460742153",
                "174976771785859199351585760380451925891",
                "3269041531278583164209670663009968739",
                "180018730530207961179690335094871309440",
                "29112516508699203861611327428513999307"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-13586-70db74c5",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13586-878b0d7f",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "engineLoad"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "160006464268051548589183745060655853009",
            "length": 6385.0
        },
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "80131999752521269621094373818065807089",
                "235247414574371671360904968103883342654",
                "71179469984323401089659484245823125068",
                "229227395035598765600064513616912218319",
                "71411323181059277032491098005985236354",
                "78256143013997344661556856569173490409",
                "23335947030539593210977585011008101248",
                "37458143115277431710122611788528433915"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"
        },
        "id": "CVE-2026-13586-878e1de5",
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13586-9300be14",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "createCipher"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "146185488275992488887332358375286785687",
            "length": 1569.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-9e7e1d0b",
        "signature_version": "v1",
        "target": {
            "file": "pkix/src/test/java/org/bouncycastle/pkcs/test/AllTests.java",
            "function": "suite"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "digest": {
            "function_hash": "194860580165028437170906840973268183556",
            "length": 228.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-aa9648b5",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "unwrapKey"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "60233060954462720211381643716690262486",
            "length": 1131.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-ad1829d0",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "wrapKey"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "260422492601392403562186346117797932263",
            "length": 546.0
        },
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "validateIterationCount"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "116221452488317856134917323005502106492",
            "length": 413.0
        },
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "id": "CVE-2026-13586-bbd79c51",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "calculatePbeMac"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "93375355927373822278453117652364768883",
            "length": 1991.0
        },
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "id": "CVE-2026-13586-c4bbc0fb",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-c678e842",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "wrapKey"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "function_hash": "121702520498743548110237886020351221027",
            "length": 765.0
        },
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "206748540790074696337505260012348881304",
            "length": 1551.0
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "calculatePbeMac"
        },
        "deprecated": false,
        "id": "CVE-2026-13586-c7ae20f9",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "cryptData"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "159690551868197960726744589442781624402",
            "length": 1082.0
        },
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "id": "CVE-2026-13586-d599400a",
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "116221452488317856134917323005502106492",
            "length": 413.0
        },
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "validateIterationCount"
        },
        "deprecated": false,
        "id": "CVE-2026-13586-d9245bbf",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13586-de56c1a4",
        "signature_version": "v1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"
        },
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "digest": {
            "line_hashes": [
                "186267376115903364161411840572558251985",
                "296066507252470120857135363768847807999",
                "290093104057884090090474193609121918561",
                "205918715542660857782771208013955742816",
                "203338385865972582371335440685867743462",
                "128086724510568589507423273138909535729",
                "119333703086741099737182090765603630466",
                "93973905555515000199249510521519565321",
                "208396192308354091077788005293890669977",
                "311772047338465315272424520962557666664",
                "327124414811670576514194755936746409171",
                "257048045848677049050505552714157391068",
                "49254691501117575229969552818390783668",
                "119771261517632398768694931105263379870",
                "317927588361279682485634066879971875636",
                "295819596676669900034606820134177073093",
                "295014962174494862872642169295092346607",
                "303783603005723667043485208396720639642",
                "211265271394268614071701412810252427378",
                "77053077633367560711092385240446794401",
                "190393130149868586934603915656788167379",
                "309140075013886866363850966866134934721",
                "175181431784148470477459107558890167204",
                "219362836210687277728331793336107334205",
                "329313061056581148003462803825968205549",
                "155355858991820424638986758364333888002",
                "58727660367401372577776130517093109458",
                "61160657492518341801213690588455410814",
                "250856427967907284945929896316294199984",
                "297438165167804991066600862768054515323",
                "318047407856471509670282872128808013611",
                "338960050301613200318359531028625148086",
                "334706030641651553261034467895394168234",
                "49596540536659556908514128872969795928",
                "247851895956743132288286212747620836151",
                "265756991474920976443745343234199753018",
                "333074141710635353878506192750459148821",
                "175692723456558492451769326069653613131",
                "191689455484828277718995307378487462058",
                "308794137792613564776022329912718381768",
                "242175138703892252163742447061410442056",
                "330837984345337234066173445908700981695",
                "177847441051607181338372963963312370839",
                "197978004139751473205214522304045275430",
                "79832297816223048015604016824572237095",
                "320077132895002814259988282438781302511",
                "103020380501349872512924345579020806624",
                "69018421287854072595061998164338807947",
                "236547675343145943181538354309409111099",
                "127111734054559714967648608900847403015",
                "211601684207564780056580125922272999520",
                "42318915853577061003633144088761641246",
                "303597983800682589197997361011603778284",
                "13110806998893626838480489771906972101",
                "150543915750858159598496691852742417315",
                "205605652308111586549537427977721999130",
                "100319644078267214837368760618091605546",
                "316608026583348886568770007000726371718",
                "127867363184847686115953433324652442023",
                "143169495143164690536758284726745117664",
                "155018470219325109631894984771889241634",
                "138163910965300236136401161206903735542",
                "141800620852228603329831116705821511922",
                "209567004073084408918386233892666789465",
                "24638869168397144488517348989416597460",
                "258270239185139516247935102615460742153",
                "174976771785859199351585760380451925891",
                "3269041531278583164209670663009968739",
                "180018730530207961179690335094871309440",
                "29112516508699203861611327428513999307"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "engineLoad"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "322539889662986565240740998327060816010",
            "length": 6342.0
        },
        "signature_version": "v1",
        "id": "CVE-2026-13586-f807be16",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "createCipher"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "78695185909752481092397783647944872932",
            "length": 2005.0
        },
        "signature_version": "v1",
        "id": "CVE-2026-13586-f9399188",
        "source": "https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96",
        "signature_type": "Function"
    },
    {
        "source": "https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/util/Properties.java"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "224857865166323732974720216857961116073",
                "76122832230332266770156834571286201058",
                "233562828850542885918997873421632220258"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-13586-fb565e6a",
        "signature_version": "v1",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13586.json"
vanir_signatures_modified 
"2026-08-12T15:33:35Z"