CVE-2026-71885 - MLS X.509 credential not bound to the LeafNode signature key
CVE ID :CVE-2026-71885 Published : Oct. 3, 2026, 8:51 a.m. | 32 minutes ago Description :In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's...