Bouncy Castle 1.86 Released To Patch MLS Authentication Vulnerability
The Bouncy Castle cryptographic library has been updated to version 1.86 to fix a flaw in its Messaging Layer Security implementation that could allow unauthorized identity spoofing.
Bouncy Castle cryptographic library version 1.86 is out to patch CVE-2026-71885. This vulnerability sits in the Messaging Layer Security implementation. Previously, the library failed to properly bind X.509 credentials to the leaf signature key.
That binding process authenticates agent-to-agent communication channels. Without it, unauthorized entities could manipulate or spoof participant identities within a secure session. The old code failed to verify that the signature key matched the provided X.509 certificate, breaking authentication integrity.
Update.
Version 1.86 correctly links X.509 credentials to signature keys. If you use the Bouncy Castle library for MLS implementations, check the official release notes on the project's website for technical details and apply the update to protect messaging channels against impersonation and credential-related exploits.