CVE-2007-6721
Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
Exploit likelihood
What each source reports
NVD Score used
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
CVE-2007-6721- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
CVE-2007-6721- Updated
- 2026-11-02
EUVDEUVD-2022-4466 No score
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
EUVD-2022-4466- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m26p-m559-g5j5 No score
Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
GHSA-m26p-m559-g5j5- Weakness
- CWE-203
- Updated
- 2026-11-02
OSV No score
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
CVE-2007-6721- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6721 No score
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
DEBIAN-CVE-2007-6721- Updated
- 2026-11-02
OSVGHSA-m26p-m559-g5j5 No score
Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
- Record
GHSA-m26p-m559-g5j5- Weakness
- CWE-203
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bouncycastle:bcprov-jdk14Maven |
before 1.38 | 1.38 |
bouncycastle:bcprov-jdk15Maven |
before 1.38 | 1.38 |
bouncycastle:bcprov-jdk16Maven |
before 1.38 | 1.38 |
bouncycastleDebian:12 |
before 1.38-1 | 1.38-1 |
bouncycastleDebian:13 |
before 1.38-1 | 1.38-1 |
bouncycastleDebian:14 |
before 1.38-1 | 1.38-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, cwes, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6721 is a high vulnerability (CVSS 10.0) in Bouncycastle Bc-java, published March 30, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.41%, the 84th percentile. Fixed in bouncycastle:bcprov-jdk14 1.38.
References
freshmeat.net/projects/bouncycastlecryptoapi/releases/265580
osvdb.org/50358
bouncycastle.org/csharp
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2007-6721
web.archive.org/web/20071022023551/http://www.bouncycastle.org/csharp
github.com/advisories/GHSA-m26p-m559-g5j5
security-tracker.debian.org/tracker/CVE-2007-6721