Veille CVE

Recherche « Bouncycastle bc-java »

39 CVE

Critique 3 Élevée 24 Moyenne 12 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Bouncycastle bc-java » ✕
  1. CVE-2026-97873 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA

    In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKeyFactory in these families derived with whatever count it was given, including one decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected private key with BC. Both the parameter parse and the derivations now reject a negative or over-limit count under the org.bouncycastle.pbe.max_iteration_count property (default 10,000,000) that already bounded PBKDF2 (CVE-2026-17508), and the parse rejects a count beyond the int range rather than narrowing it. This issue also affects Bouncy Castle for Java LTS before 2.73.13.

  2. CVE-2026-71892 6.9 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-FJA

    In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The branch that should have selected the actual content-encryption algorithm carried in the key derivation AlgorithmIdentifier's parameters compared the encrypted-key byte array against the id-alg-cek-hkdf-sha256 object identifier, a comparison between a byte array and an ASN1ObjectIdentifier that is false for every possible input, so the check fell through to a key-size lookup on the outer wrapper OID. That OID identifies a key-derivation construction rather than a cipher and has no registered key size, so the size comparison was skipped entirely. A key-transport EnvelopedData or AuthEnvelopedData whose transported, HKDF-derived content-encryption key did not match the key size of the advertised content-encryption algorithm was therefore accepted even with validation explicitly enabled, silently defeating the only mechanism the API offers for enforcing recovered key size. The recipient now dispatches on the content-encryption AlgorithmIdentifier's algorithm OID, so validation checks the recovered key against the inner content-encryption algorithm. Messages with a matching key size, non-HKDF messages, and recipients that do not enable validation are unaffected. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  3. CVE-2026-71890 8.7 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA

    In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to do with the joiner. RFC 9420 sec. 12.2 permits at most one Remove proposal in an external commit, with which the joiner removes an old version of themselves, and requires that where one is present the LeafNode in the commit's path field meet the criteria it would have to meet in an Update for the removed leaf, in particular that its credential present identifiers acceptable for the removed participant. The ordinary proposal-list validator's self-remove rule is deliberately not applied on this path, because a resync commit legitimately removes a leaf the joiner owns, but nothing was put in its place. Any party holding the group's public GroupInfo, which is precisely what an external joiner is meant to be given, could therefore commit a Remove naming any member's LeafIndex and have every member apply it, evicting that member and taking over their slot in the ratchet tree. The credential check that should have prevented this existed only in the gRPC interop harness and so protected no other caller of the public Group.externalJoin and Group.handle API. An external commit carrying a Remove is now accepted only when the removed leaf's credential is identical to the one in the joiner's own new leaf, on both the sending and the receiving side.

  4. CVE-2026-71889 8.7 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA

    In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its own issuing CA therefore reported isValidCertPath() true with an empty error list, while CertPathValidator.getInstance("PKIX", "BC"), which shares no code with the reviewer, rejected the identical chain against the identical trust anchor. An application using the reviewer to make the trust decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA was never authorised to issue. Both copies now check every certificate in the path including the target, waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  5. CVE-2026-17508 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA

    In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  6. CVE-2026-17507 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.

  7. CVE-2026-14682 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

  8. CVE-2026-13586 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  9. CVE-2026-13506 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  10. CVE-2026-12860 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  11. CVE-2026-12852 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

  12. CVE-2026-12817 8.6 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  13. CVE-2026-12816 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  14. CVE-2026-12803 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  15. CVE-2026-12802 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  16. CVE-2026-58063 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  17. CVE-2026-58062 9.1 Critique

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  18. CVE-2026-58061 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  19. CVE-2026-58060 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  20. CVE-2026-58059 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  21. CVE-2026-8763 9.1 Critique

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  22. CVE-2026-59652 6.5 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

  23. CVE-2026-59651 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  24. CVE-2026-59650 9.1 Critique

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  25. CVE-2026-59649 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  26. CVE-2026-59648 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  27. CVE-2026-59647 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  28. CVE-2026-59646 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

  29. CVE-2026-59645 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

  30. CVE-2026-59644 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

  31. CVE-2026-59643 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java · Bouncycastle bcpg-fips

    In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

  32. CVE-2026-59642 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  33. CVE-2026-59641 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

  34. CVE-2026-59640 5.3 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

  35. CVE-2026-59639 7.5 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  36. CVE-2026-59638 6.5 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

  37. CVE-2026-15055 8.2 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Legion of the Bouncy Castle Inc. BC-FJA · Bouncycastle bc-java

    In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  38. CVE-2026-12185 8.6 Élevée

    Legion of the Bouncy Castle Inc. BC-JAVA · Legion of the Bouncy Castle Inc. BC-LTS-JAVA · Bouncycastle bc-java · Bouncycastle bouncy castle for java lts

    In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

  39. CVE-2024-14041 5.9 Moyenne

    Legion of the Bouncy Castle Inc. BC-JAVA · Bouncycastle bc-java

    In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.