Legion Of The Bouncy Castle Inc. vulnerabilities, page 4

85 vulnerabilities

Known vulnerabilities in Legion Of The Bouncy Castle Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 13 products.

5.3MediumCVE-2026-58063chainguard · bouncycastle-fips +8 moreBCFKS keystore load honours unbounded KDF cost from untrusted fileIn Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.42%8.7HighCVE-2026-58061chainguard · bouncycastle-fips +8 moreCCM-family modes write plaintext to caller buffer before tag checkIn Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.28%8.7HighCVE-2026-58060chainguard · bouncycastle-fips +8 moreHSS public-key level count unbounded, enabling huge allocation on verifyIn Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.62%9.3CriticalCVE-2026-58062chainguard · bouncycastle-fips +18 moreStapled OCSP response accepted without binding to the checked certificateIn Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.36%8.7HighCVE-2026-58059chainguard · bouncycastle-fips +8 moreQuadratic-time escaping when stringifying X.500 distinguished namesIn Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.49%8.2HighCVE-2026-18036debian · bouncycastle +2 moreNTRU leaks private key information by reducing secret values with a non-constant-time integer divisionIn Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.EPSS0.28%5.9MediumCVE-2026-18040debian · bouncycastle +2 moreHQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight samplerIn Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.EPSS0.11%7.5HighCVE-2026-5588chainguard · apache-nifi +211 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.EPSS0.69%8.9HighCVE-2026-5598chainguard · apache-hop +151 moreNon-constant time comparisons risk private key leakage in FrodoKEM.Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.EPSS0.96%1.7LowCVE-2026-15997ubuntu · bouncycastle +1 moreNative ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded stateOut-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C. This issue affects BC-LTS: from 2.73.0 before 2.73.12.1. Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.EPSS0.14%8.2HighCVE-2026-15999legion of the bouncy castle inc. · bc-csharpAES-CCM decryption accepts zero or out-of-range tag length, bypassing authenticationImproper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declare an authentication tag (aes-ICVlen) of zero or another length outside the RFC 5084 set, because CcmParameters accepted any value and CcmBlockCipher validated the tag length only when encrypting, so decryption compared a zero-length or very short tag. Affected paths include ParameterUtilities.GetCipherParameters, used by CmsEnvelopedData and CmsEnvelopedDataParser for EnvelopedData encrypted with AES-CCM, and any caller passing an unchecked tag length to CcmBlockCipher for decryption.EPSS0.23%8.2HighCVE-2026-15055bouncycastle · bc-java +7 morePKCS#8 / PBES2 decryptors honour unbounded KDF cost from inputIn Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).EPSS0.34%8.6HighCVE-2026-12185bouncycastle · bc-java +5 moreBKS/UBER keystore allocates from untrusted lengths before integrity checkIn Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.EPSS0.29%8.7HighCVE-2026-12852bouncycastle · bc-java +3 moreMLS wire decoder allocates attacker-declared opaque length before bounds checkIn Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.EPSS0.31%8.7HighCVE-2026-12860bouncycastle · bc-java +5 moreRSA PKCS#1 verification skips last two hash bytes in NULL-omitted pathIn Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.EPSS0.17%8.7HighCVE-2026-12803bouncycastle · bc-java +5 moreKCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.EPSS0.20%8.7HighCVE-2026-12802bouncycastle · bc-java +7 moreCMS AuthEnvelopedData fails to enforce tag-length on decryptionIn Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).EPSS0.15%8.7HighCVE-2026-12816bouncycastle · bc-java +5 moreIESEngine stream-mode MAC forgery via length-dependent KDF splitIn Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.EPSS0.18%8.7HighCVE-2026-12817bouncycastle · bc-java +7 moreOpenPGP AEAD decryption skips final tag on chunk-aligned dataIn Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).EPSS0.17%9.3CriticalCVE-2026-8763chainguard · airbyte-platform-workload-launcher +172 moreName Constraints bypass via trailing dot in rfc822Name and URIIn Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).EPSS0.43%