diff --git a/core/src/main/java/org/bouncycastle/crypto/digests/Blake2bpDigest.java b/core/src/main/java/org/bouncycastle/crypto/digests/Blake2bpDigest.java
@@ -63,7 +63,7 @@ public void update(byte in)
     public void update(byte[] message, int offset, int len)
     {
         int left = bufferPos;
-        int remainingLength = 8*BLAKE2B_BLOCKBYTES - left;
+        int remainingLength = PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES - left;
 
         if(left != 0 && len >= remainingLength)
         {

diff --git a/core/src/test/java/org/bouncycastle/crypto/test/AllTests.java b/core/src/test/java/org/bouncycastle/crypto/test/AllTests.java
@@ -21,6 +21,7 @@ public static Test suite()
         suite.addTestSuite(SimpleTestTest.class);
         suite.addTestSuite(GCMReorderTest.class);
         suite.addTestSuite(HPKETestVectors.class);
+        suite.addTestSuite(Blake2bpDigestTest.class);
         return new BCTestSetup(suite);
     }
 

diff --git a/core/src/test/java/org/bouncycastle/crypto/test/Blake2bpDigestTest.java b/core/src/test/java/org/bouncycastle/crypto/test/Blake2bpDigestTest.java
@@ -119,4 +119,69 @@ public void testReset()
             }
         }
     }
+
+    public void testMultiPartUpdate()
+    {
+        // unkeyed BLAKE2bp of the 1100 byte message 00 01 02 .. ff 00 01 ..
+        byte[] expected = Hex.decode("1fbb59626e91bb75333395159d754453bfe699609d617d0ca94fa5028aaac576f2fa9c6f31d511341256132f65e24ce78097060800465113298fbd069f3c988f");
+        byte[] key = new byte[64];
+        byte[] buf = new byte[1100];
+        byte[] hash = new byte[64];
+
+        for (int i = 0; i < key.length; i++)
+        {
+            key[i] = (byte) i;
+        }
+        for (int i = 0; i < buf.length; i++)
+        {
+            buf[i] = (byte) i;
+        }
+
+        Blake2bpDigest digest = new Blake2bpDigest(null);
+        digest.update(buf, 0, buf.length);
+        digest.doFinal(hash, 0);
+        assertTrue("BLAKE2bp mismatch on long message", Arrays.areEqual(expected, hash));
+
+        Blake2bpDigest keyedDigest = new Blake2bpDigest(key);
+        byte[] keyedExpected = new byte[64];
+        keyedDigest.update(buf, 0, buf.length);
+        keyedDigest.doFinal(keyedExpected, 0);
+
+        for (int step = 1; step <= buf.length; step++)
+        {
+            for (int pOffset = 0; pOffset < buf.length; pOffset += step)
+            {
+                int len = Math.min(step, buf.length - pOffset);
+
+                digest.update(buf, pOffset, len);
+                keyedDigest.update(buf, pOffset, len);
+            }
+
+            digest.doFinal(hash, 0);
+            assertTrue("BLAKE2bp mismatch on update step " + step, Arrays.areEqual(expected, hash));
+
+            keyedDigest.doFinal(hash, 0);
+            assertTrue("keyed BLAKE2bp mismatch on update step " + step, Arrays.areEqual(keyedExpected, hash));
+        }
+
+        for (int split = 0; split <= buf.length; split++)
+        {
+            digest.update(buf, 0, split);
+            digest.update(buf, split, buf.length - split);
+            digest.doFinal(hash, 0);
+            assertTrue("BLAKE2bp mismatch on update split " + split, Arrays.areEqual(expected, hash));
+
+            keyedDigest.update(buf, 0, split);
+            keyedDigest.update(buf, split, buf.length - split);
+            keyedDigest.doFinal(hash, 0);
+            assertTrue("keyed BLAKE2bp mismatch on update split " + split, Arrays.areEqual(keyedExpected, hash));
+        }
+
+        for (int i = 0; i < buf.length; i++)
+        {
+            digest.update(buf[i]);
+        }
+        digest.doFinal(hash, 0);
+        assertTrue("BLAKE2bp mismatch on single byte update", Arrays.areEqual(expected, hash));
+    }
 }
diff --git a/docs/releasenotes.md b/docs/releasenotes.md
@@ -63,6 +63,7 @@ Date: 2026, TBD
 - The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
 - The raw JCA provider bounded the PBKDF2 iteration count taken from an encoding (org.bouncycastle.pbe.max_iteration_count, default 10,000,000) but not the counts of the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families beside it. Their AlgorithmParameters (PKCS12PBE and its OID aliases, PBKDF1) accepted any count, narrowing one beyond the int range with intValue() so that 2^32 arrived as 0, and every Cipher, Mac and SecretKeyFactory derivation ran with whatever count it was given - including a count decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected key with BC. As these schemes carry the count in unauthenticated parameters and derive before anything can be checked, a supplied blob could hold a derivation for tens of minutes. The parameter parse now rejects a negative, beyond-int or over-limit count, and the derivations reject a negative or over-limit count, under the same property as PBKDF2. The PKCS#12 key store derives through the same code, so a org.bouncycastle.pkcs12.max_it_count raised above 10,000,000 now needs org.bouncycastle.pbe.max_iteration_count raised with it.
 - The light-weight CryptoProWrapEngine (RFC 4357 sec. 6.3) diversified the key encryption key in the caller's own array, so after init the KeyParameter it was given held the diversified key, and initialising again with the same parameters - to unwrap what had just been wrapped, say - diversified it a second time and used a different key. It also failed with a NullPointerException when given no S-box, although init has a branch for that case. It now diversifies a copy, and given no S-box uses the GOST 28147 engine's default S-box for the diversification, the one the wrap itself then uses. The provider's GOST 28147 key wrap ciphers were unaffected, as they always supply an S-box and build a new KeyParameter on every init.
+- The light-weight Blake2bpDigest could return a wrong digest, or fail with an ArrayIndexOutOfBoundsException, when a message longer than 512 bytes was passed to it in more than one call, and hashing a byte at a time failed at the 513th byte. The digest buffers one 128 byte block for each of its four leaves, 512 bytes in all, but update() measured the room left in that buffer against eight blocks, so once input was buffered a later call that did not fit in the room left either tried to copy past the end of the buffer or, with no error raised, hashed part of its input ahead of the bytes still waiting there. One-shot hashing and messages of 512 bytes or fewer were unaffected, as was Blake2spDigest, whose buffer holds eight of its 64 byte blocks. The room left is now measured against the four blocks the buffer holds.
 
 ### 2.1.3 Additional Features and Functionality