CVE-2026-8149 / GHSA-mx76-r943-rf8g on bc-fips:2.1.2

[MNKCrypto]

In our org, we are currently using org.bouncycastle:bc-fips:2.1.2 and noticed the recently published advisory for CVE-2026-8149 / GHSA-mx76-r943-rf8g.

Could you please share:

whether a patched GA release for bc-fips is planned,
the expected version number,
and if there is an estimated timeline for availability?

We also noticed references to 2.1.3-SNAPSHOT, so we wanted to confirm whether an official production-ready release is expected soon.

Thank you for your help and for maintaining the project.

[ldapster]

Hi is there any updated status on on this CVE?