Bouncycastle Bc-java vulnerabilities

• bouncycastle bc-java MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender CVE-2026-17507 Fix available 8.7 HighOctober 2, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) CVE-2026-13586 Fix available 5.3 MediumAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Lazy ASN.1 sequence forcing resets nesting-depth guard CVE-2026-13506 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path CVE-2026-12860 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bc-java MLS wire decoder allocates attacker-declared opaque length before bounds check CVE-2026-12852 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more OpenPGP AEAD decryption skips final tag on chunk-aligned data CVE-2026-12817 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more IESEngine stream-mode MAC forgery via length-dependent KDF split CVE-2026-12816 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) CVE-2026-12803 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more CMS AuthEnvelopedData fails to enforce tag-length on decryption CVE-2026-12802 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bctls-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +3 more +5 more Possible OOM from unbounded up-front allocation on a definite-length read CVE-2026-14682 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Quadratic-time escaping when stringifying X.500 distinguished names CVE-2026-58059 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more HSS public-key level count unbounded, enabling huge allocation on verify CVE-2026-58060 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more CCM-family modes write plaintext to caller buffer before tag check CVE-2026-58061 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Stapled OCSP response accepted without binding to the checked certificate CVE-2026-58062 Public exploitFix available 9.3 CriticalAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more BCFKS keystore load honours unbounded KDF cost from untrusted file CVE-2026-58063 Fix available 5.3 MediumAugust 3, 2026
• bouncycastle bctls-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVE-2026-59638 Fix available 9.3 CriticalAugust 3, 2026
• bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more CMS verifySignatures returns true for SignedData with zero signers CVE-2026-59639 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more OpenPGP CFB quick-check oracle active on symmetric/session-key paths CVE-2026-59640 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcjmail-fips, bcmail-fips, bouncy castle for java lts +3 more +5 more S/MIME validator trusts signer-asserted signingTime for path validation CVE-2026-59641 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more CMS AuthenticatedData content not bound to MAC when authAttrs present CVE-2026-59642 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpg-fips, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more OpenPGP inline-signature policy failures silently ignored CVE-2026-59643 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bc-java MLS hash-ratchet honours arbitrary 32-bit generation counter from sender CVE-2026-59644 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcutil-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more OER parser recurses without depth limit on self-referential IEEE 1609.2 schema CVE-2026-59645 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bctls-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more DTLS handshake reassembler allocates buffer from unchecked 24-bit length CVE-2026-59646 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more CRMF/CMP password-MAC honours unbounded iteration count CVE-2026-59647 Fix available 6.9 MediumAugust 3, 2026
• bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more OpenPGP Argon2 S2K honours attacker-chosen memory and passes CVE-2026-59648 Fix available 6.9 MediumAugust 3, 2026
• bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more OpenPGP user-attribute subpacket length bounded only by JVM max memory CVE-2026-59649 Fix available 8.7 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more MTI/A0 DH agreement exponentiates unvalidated peer value CVE-2026-59650 Fix available 9.3 CriticalAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more BKS keystore accepts legacy version with 16-bit integrity MAC key CVE-2026-59651 Fix available 7.1 HighAugust 3, 2026
• bouncycastle bc-java LDAP filter injection in legacy jdk1.4 LDAPStoreHelper CVE-2026-59652 Fix available 6.9 MediumAugust 3, 2026
• bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 more BKS/UBER keystore allocates from untrusted lengths before integrity check CVE-2026-12185 Fix available 7.1 HighAugust 3, 2026
• bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 more Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 Fix available 9.3 CriticalAugust 3, 2026
• bouncycastle bcpkix-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 more PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input CVE-2026-15055 Fix available 5.3 MediumAugust 3, 2026
• bouncycastle bc-java ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) CVE-2024-14041 Fix available 8.2 HighJuly 28, 2026
• bouncycastle bc-fja, bc-java, bc c .net +2 more Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. CVE-2024-29857 Fix available 7.5 HighMay 9, 2024
• bouncycastle bc-java Bouncy Castle For Java LDAP injection vulnerability CVE-2023-33201 Fix available 5.3 MediumJuly 1, 2023
• apache karaf, bouncycastle bc-java, oracle banking corporate lending process management +17 more +19 more Logic error in Legion of the Bouncy Castle BC Java CVE-2020-28052 Public exploitFix available 8.1 HighDecember 18, 2020
• apache tomee, bouncycastle bc-java, netapp active iq unified manager +18 more +20 more Out-of-Memory Error in Bouncy Castle Crypto CVE-2019-17359 Fix available 7.5 HighOctober 8, 2019
• bouncycastle bc-java, netapp oncommand workflow automation, opensuse leap +21 more +23 more Deserialization of Untrusted Data in Bouncy castle CVE-2018-1000613 Fix available 9.8 CriticalJuly 9, 2018
• bouncycastle bc-java, fips java api, debian linux +17 more +19 more Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator CVE-2018-1000180 Fix available 7.5 HighJune 5, 2018
• bouncycastle bc-java In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode CVE-2016-1000352 Fix available 7.4 HighJune 4, 2018
• bouncycastle bc-java In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode CVE-2016-1000344 Fix available 7.4 HighJune 4, 2018
• bouncycastle bc-java The Bouncy Castle JCE Provider carry a propagation bug CVE-2016-1000340 Fix available 7.5 HighJune 4, 2018
• bouncycastle bc-java, debian linux +1 more In Bouncy Castle JCE Provider the other party DH public key is not fully validated CVE-2016-1000346 Fix available 3.7 LowJune 4, 2018
• bouncycastle bc-java, debian linux +1 more Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 CVE-2016-1000345 Fix available 5.9 MediumJune 4, 2018
• bouncycastle bc-java, debian linux +1 more In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values CVE-2016-1000343 Fix available 7.5 HighJune 4, 2018
• bouncycastle bc-java, debian linux +1 more In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification CVE-2016-1000342 Fix available 7.5 HighJune 4, 2018
• bouncycastle bc-java, debian linux +1 more Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 CVE-2016-1000341 Fix available 5.9 MediumJune 4, 2018
• bouncycastle bc-java, debian linux +1 more Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 CVE-2016-1000339 Fix available 5.3 MediumJune 4, 2018
• legion of the bouncy castle bouncy castle, bouncycastle bc-java, redhat satellite +1 more +3 more Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions CVE-2018-5382 Fix available 4.4 MediumApril 16, 2018
• Show olderLoading…