Release date: October 1, 2026
Platform
- (KI-027614) LiveAssurance now uses an updated version of the
Bouncy Castle cryptographic library, and other updated third-party
dependencies. This addresses the following critical vulnerabilities:
- CVE-2026-59638 (JSSE hostname verifier CN-fallback enabled by default despite documented opt-in)
- CVE-2026-59650 (MTI/A0 DH agreement exponentiates unvalidated peer value)
- CVE-2026-8763 (Name Constraints bypass via trailing dot in rfc822Name and URI)