CVE-2026-58062

CVE-2026-58062 is a trust model inversion, not a cryptographic break. Bouncy Castle's OCSP stapling validation fails to enforce that a stapled OCSP response actually corresponds to the certificate being validated. An attacker with MITM position who has harvested a valid OCSP staple from one TLS exchange can replay it during an attack against a completely different certificate — and revocation checking becomes theater. The CVSS 9.3 reflects genuine technical severity: you've lost the binding between a credential and its validation context. But the EPSS of 0.00203 tells a different story — this isn't a scriptable vulnerability. Exploitation requires a precise network position and a harvested staple. That said, the 'active MITM' prerequisite is collapsing into infrastructure reality. Corporate proxies staple OCSP on behalf of users. Centralized TLS termination is standard in Java middleware. CI/CD pipelines inspect encrypted traffic. If you're behind any of these, the attacker's position already exists in your environment — they don't need to engineer it from scratch. The four-version spread (BC 1.85, 2.73.12, BC-FJA 2.0.2, 2.1.3) is the signal piece. This isn't scattered negligence — it's the same unmaintained validation logic copied forward across lineages without the binding assumption ever being enforced at the API level. Bouncy Castle exposes OCSP operations as discrete functions rather than requiring certificate binding as a mandatory structural constraint. That's a tooling failure that permitted incorrect implementations without compilation or runtime friction. What amplifies this: BC sits in foundational infrastructure — backends, HSM integrations, PKI management platforms — not just application code. If the client-side validation path is your exposure, one compromised proxy means every Java process behind it has revocation checking silently disabled. If the server-side path is vulnerable (where servers generate staples), an attacker compromises one BC server, harvests a fresh staple, then uses it against downstream targets. The prerequisite collapses to 'compromise any BC server.' For defenders: map your BC dependency tree first. Determine whether your code exercises OCSP stapling at all — many deployments won't. If it does, validate that your implementation explicitly binds OCSP responses to their source certificates rather than treating the staple as self-validating. Watch the gap between this disclosure and your remediation: every unpatched day is a day attackers accumulate inventory from compromised BC servers. The EPSS measures today's spray-and-pray exploitation, not targeted operations against high-value systems that already have the attacker's foot in the door.

Reviewed through automated stages and approved by a human before publication.