BouncyCastle has a new release. Updating should be painless, and prevent discussion around potential CVE impact.