Upgrade bouncycastle to version 1.84 due to 3rd-party vulnerabilities CVE-2026-3505, CVE-2026-5598

Current Situation

Currently JS7 components Controller, Agent and JOC Cockpit ship with bouncycastle libraries 1.81 (2.5.x and 2.7.x releases) and 1.82 (2.8.x releases). These libraries are affected by the vulnerability.

Currently we rate the impact of the vulnerability to be low. Also, no official impact rating has been publicly provided yet.

Desired Behavior

JS7 components Controller, Agent and JOC Cockpit should ship with bouncycastle version 1.84 that fixes the issue.

Immediate Measures

Customers can replace the existing bouncycastle libraries with the current version of these libraries.

Releases 2.5.x 

• bcpkix-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcpkix-jdk15to18
• bcpg-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcpg-jdk15to18
• bcprov-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcprov-jdk15to18
• bcutil-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcutil-jdk15to18

Releases 2.7.x and 2.8.x

• bcpkix-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcpkix-jdk18on
• bcpg-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcpg-jdk18on
• bcprov-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcprov-jdk18on
• bcutil-jdk18on
  • https://central.sonatype.com/artifact/org.bouncycastle/bcutil-jdk18on