CVE-2026-0636

Aliases:GHSA-c3fc-8qff-9hwxDEBIAN-CVE-2026-0636CGA-2g33-83pf-6x53CGA-2g3v-768h-pcr3CGA-2jwh-3522-6jqpCGA-2qjh-x3fw-94mqCGA-2rvh-835f-whr5CGA-32xq-9pj9-jjxqCGA-3362-vhr9-qjf5CGA-3q27-vh2v-5w76CGA-3q9r-hvwq-pqrqCGA-3rq3-h52f-wv35CGA-3x32-942q-rjf7CGA-49mm-3r4f-vmmcCGA-4ff7-46wx-m265CGA-4gqg-rr72-qvx6CGA-4j47-93w8-c6cpCGA-4pqg-r734-228hCGA-4wc9-wp2g-4jwmCGA-52gg-hfj4-p2p3CGA-52q9-c923-j8hvCGA-5g49-2j79-578fCGA-5j43-rc6g-65hxCGA-5wj4-mc68-ppq2CGA-5x3c-5mmc-3mrpCGA-67j8-2xv2-3jx9CGA-6c89-wwm3-7vwmCGA-6hrj-4946-6pq7CGA-6qf2-w6x9-29qrCGA-77jq-x2hj-9v5wCGA-7cvx-qp74-3wg9CGA-7mwp-mgw7-w4wgCGA-84rx-4wrh-mxpfCGA-86cx-6mfq-h5xpCGA-8m48-62p3-w37wCGA-8xqh-xxcw-929qCGA-939p-pw6j-w7c2CGA-97q2-8gvx-jqffCGA-98rj-mc5r-p4p9CGA-98rj-v44q-qpwpCGA-9c57-c3xq-f3r4CGA-9fwc-3gfv-qr7jCGA-9r3v-2j7x-2m2vCGA-c5vv-64v4-j9g4CGA-cc2h-pvfj-v26pCGA-f3q9-h45j-c3gqCGA-f925-j788-hwf7CGA-f98f-whhj-xf9xCGA-fh37-m728-w23xCGA-fq2q-j57m-4p6qCGA-fv6w-97wc-qq6mCGA-g3pg-wv34-xmjjCGA-g5w6-chh6-8454CGA-h3fc-9q5r-r988CGA-hcq8-m388-7w5hCGA-hhqm-7w3f-wh4jCGA-hj7h-c8j3-rg6gCGA-hmwj-jpfx-m2h6CGA-hrqj-44cx-jc33CGA-j27g-jhj3-ch9xCGA-j5f7-5wh4-877hCGA-jg3j-j4gq-892vCGA-jmv9-gww4-fgmqCGA-jqrp-6hp2-jcxgCGA-jr5g-h458-22x2CGA-jrgh-mcf9-ggh2CGA-jxv2-2m32-phqpCGA-m3f3-784f-f9g6CGA-m56c-5rhc-9fvpCGA-mwqx-287j-42pmCGA-mwwc-39x5-mm2pCGA-p224-h685-47wwCGA-pcfj-jf5j-rfp2CGA-ph6h-hv64-2vxmCGA-pm6v-fffv-59xmCGA-ppmj-h7p2-725hCGA-pw4v-vj6h-g6mcCGA-pwch-vprm-94p6CGA-266x-g497-vgf8CGA-2f97-rg8x-xrj8CGA-2jq3-29wm-rp5hCGA-2ph9-6mrp-mjjmCGA-2q68-xc3p-vp2fCGA-2q6f-8788-vvr6CGA-2rw7-f2p8-hj7pCGA-2vpc-j7gf-859qCGA-2xrj-vgq2-f864CGA-32pj-4499-99jfCGA-32wm-ggxx-xwh8CGA-3957-f722-5778CGA-3c32-h89h-p8x2CGA-3c5h-4qmm-5wr4CGA-3h5f-55m6-pc75CGA-3jqg-mmc7-x94qCGA-3mwg-6m9g-446xCGA-3p7f-89r8-7xw8CGA-3r7r-fqg5-5wx3CGA-3xq5-5333-f8xpCGA-429v-g423-4qw6CGA-444w-6p56-9hmhCGA-473c-gp3j-9px8CGA-4cj8-m939-276hCGA-4gc4-c492-w8j2CGA-4gq2-4c4f-9c3vCGA-4p2j-xcfh-76rhCGA-4p9x-39qg-fhr9CGA-4pgj-cpc8-pjpjCGA-4r2f-h6j5-rqxqCGA-4r5v-m56f-wprpCGA-53c8-8mr8-v27mCGA-5589-r27h-hq2mCGA-5747-5mhw-x82jCGA-57fp-2wcw-64rpCGA-58hq-xq4v-9hwwCGA-58xc-6xjq-736rCGA-5g32-cxhq-75j4CGA-5g67-c7v8-rg38CGA-5m5w-3frr-5r74CGA-5vv7-48j6-jhg6CGA-5w77-hwf5-878cCGA-6252-rvj5-gv7wCGA-6255-cw6m-9482CGA-6455-4f2v-xm36CGA-655c-6593-988hCGA-6626-2862-f43pCGA-6f9g-7848-6559CGA-6hpx-fmvp-46q6CGA-6m53-4r6x-q9g4CGA-6w98-86xw-cx9pCGA-74pr-j7h5-9g5fCGA-74v5-95fx-5fp8CGA-76g8-838q-9r7gCGA-76j9-4rfg-qv83CGA-7hmx-5fpp-x758CGA-7j2q-65xj-hgr9CGA-7jjc-rp8j-fc5vCGA-7m7v-6f93-pfj3CGA-7vc5-hpc3-ww9wCGA-85cw-7fqg-hgvpCGA-86r4-4v4m-536wCGA-88p3-mw95-p4vvCGA-89xp-36hj-xr8qCGA-8ccm-9fxg-g9wqCGA-8cf8-jfcx-xjhgCGA-8f6h-jv43-qvjjCGA-8fgf-h3j8-jx2wCGA-8hx9-ffw4-4mr2CGA-8jhf-3f2w-44rpCGA-8jvc-rgxv-9mmpCGA-8p82-wjr2-6w8cCGA-8p8j-x43h-2vffCGA-8q9w-xq3c-h7rgCGA-8v8q-pwcc-r2g7CGA-8xvh-ff2m-gqfjCGA-92vq-vjh7-hf98CGA-93xx-fc2f-52vvCGA-94w9-mcgq-gm68CGA-95wc-x996-5rrfCGA-96v4-9x3j-489wCGA-9c34-522g-46jqCGA-9fhj-cc3h-pfx3CGA-9g2j-6wf4-8fjgCGA-9gf6-rr2q-m9hvCGA-9ghr-hph6-vgjjCGA-9gxg-vvxh-fm6gCGA-9j2x-5p6x-vc92CGA-9vh7-4w6f-4pcmCGA-9w63-53m6-hvw8CGA-9w6j-vjg2-j6hxCGA-c2f4-p2wh-wfhvCGA-c2p9-wwvh-hvj8CGA-c2q4-52w7-6mmgCGA-c475-p98r-mfrrCGA-c76f-3q5v-jp5pCGA-c996-pxjv-xh53CGA-c9mj-48xp-cvg9CGA-c9v8-vhjf-wwp6CGA-c9vg-rph2-h465CGA-cc68-cg4c-8q58CGA-ch7p-2jc2-pcxcCGA-chf8-26w4-6mxfCGA-cj5q-6wqx-vqj9CGA-crpv-76m9-h2qfCGA-f247-jwhc-cxwfCGA-f3gx-cjx4-93jvCGA-f7vg-5gpx-w2h4CGA-f8v8-rc77-rrrhCGA-fchc-grv3-84ppCGA-fh48-rr4h-r98rCGA-fmf5-8w3g-rrjvCGA-fr7q-5wxj-m54hCGA-fw4g-26g6-v4mhCGA-g445-qr83-67ccCGA-g56p-93xv-4w7pCGA-g585-f28f-w926CGA-g76x-g48r-2cvgCGA-g7gc-hhpr-6pr7CGA-g869-gww8-44jrCGA-gcp9-g4f5-gwpjCGA-gg9f-w46j-qcw4CGA-gh4h-g243-8cwgCGA-gjp9-jgpq-r2rmCGA-gjpv-gc2q-wcr7CGA-gw58-jp5c-w5vpCGA-gxgg-xmwj-69w2CGA-gxmg-rv66-vmccCGA-h29q-qjmm-4hxxCGA-h472-2h25-2qg9CGA-h48r-w3f3-gj8hCGA-h5g2-9phc-r5q9CGA-h68w-f433-m46jCGA-h863-38p7-gcc6CGA-hgwm-x753-7p9jCGA-hhhh-m2gm-5497CGA-hmgh-247m-8vfwCGA-hwgq-g58g-xhcwCGA-hwh2-9cg7-m2qvCGA-hxv4-cg5p-3f4rCGA-j473-4m42-4wwwCGA-j6vf-r92j-4hpqCGA-j8fc-xjvm-p8cpCGA-j943-6r3f-p7w8CGA-jchr-8ppr-q255CGA-jgf4-52x8-3rh8CGA-jhqj-ww3r-539vCGA-jm93-c3r3-pr42CGA-jpp5-xqm4-3rwhCGA-jr63-p58c-42jgCGA-mcv5-7gr2-gfmfCGA-mgmj-w646-hc9pCGA-mq3q-9w6r-56mrCGA-mr9m-gwgr-h77gCGA-mrjf-g86h-wj58CGA-mv27-9q96-2xfwCGA-mw82-f4x5-g7w9CGA-p5c5-p4w5-qjp2CGA-p683-699j-9r65CGA-p72r-wh7c-9f9fCGA-p7h6-42rv-fvmrCGA-p8gj-8h23-39h5CGA-pf4w-52qh-j9rqCGA-pg8g-jjww-mg3wCGA-pghf-2cjw-j6grCGA-pgp7-hj5r-fwh3CGA-php4-cf6w-3vwmCGA-pmp7-936m-5mmfCGA-pv6p-2jwq-fhv7CGA-pvjp-4662-8rj2CGA-pwph-g6fm-q457CGA-px5h-g625-4q5jCGA-q2cw-q934-mx97CGA-q337-45g6-92wrCGA-q3rx-j677-963wCGA-q53x-85pv-87p3CGA-q82j-8m98-j8wxCGA-q8v9-8992-q2m8CGA-qch6-c266-vxq3CGA-qgfq-64v4-5fwfCGA-qgq3-m837-52mhCGA-qh5j-qhjr-gfgqCGA-qhh4-xq2w-gq57CGA-qm6h-3qjf-94gfCGA-qmmj-hj4c-9pm5CGA-qp7c-vfmm-79gfCGA-qqxf-qw6v-w2xhCGA-qvg2-j754-pfg2CGA-qwcr-hh9m-q98rCGA-r2hq-7jx3-rpmhCGA-r3mh-cm5x-f9gjCGA-r527-gpgp-gqq6CGA-r673-8785-62vjCGA-r6gf-8xf3-j99fCGA-r8ch-vhfv-jx3hCGA-r8fq-hmcp-px46CGA-r8mj-p6cj-3jg5CGA-rfv8-26gq-w38hCGA-rg37-h67j-xgq9CGA-rg56-32jf-42fvCGA-rg6q-xrgx-fccqCGA-rhr4-v4wv-465wCGA-rp4h-8rq3-vmv4CGA-rqg4-qf4q-fj39CGA-rrpv-7wpv-m45hCGA-rv22-qjvf-2x6vCGA-v4hv-3gf8-fpwrCGA-v4jg-cr2m-wgp3CGA-v4xp-vq6h-89x3CGA-v5jq-q26c-2m47CGA-v6fv-g3v6-rg92CGA-v98w-6pxq-mcccCGA-v9v7-6gmc-723fCGA-vc4j-4xqr-j9p7CGA-vcpg-v9pf-573gCGA-vh3h-f49m-56wxCGA-vj2w-q75g-vpwrCGA-vpv9-9cpr-h894CGA-vqwh-qhgq-24x6CGA-vqwp-95wg-46q2CGA-vrph-v622-xhfrCGA-vrq4-c3p7-fxm6CGA-vrr9-h96c-54rpCGA-vwg8-8v6q-8mv7CGA-vxvg-7539-j62cCGA-w2c4-43f2-825cCGA-w432-37pr-c9x8CGA-w4vr-g628-v7mfCGA-w7j7-vpfp-pv2fCGA-w7rq-c928-rf35CGA-w8j5-9xpx-m74qCGA-wf97-hx7v-w4q2CGA-wh2x-2j58-qv7hCGA-wpjq-xh43-jwvrCGA-wq6q-xjr2-xfg2CGA-wqf2-gx5p-478cCGA-wr89-2364-r32gCGA-wv78-w67g-mcrcCGA-wvv2-rxf6-7xw6CGA-wwgw-gfj7-77v2CGA-x28x-7mcx-6pcmCGA-x2qm-p879-jqrpCGA-x4mv-4hp4-qwx2CGA-x554-c799-7243CGA-x5vr-gr5c-j6q8CGA-x63r-j4fp-9xqjCGA-x8jr-chjm-27xqCGA-x9h8-vw4g-cpvxCGA-xc7x-rfph-ccv9CGA-xc8x-pr8q-93h6CGA-xj6q-6cj2-h983CGA-xp2h-9jvm-4mv7CGA-xp99-j58h-rp3gCGA-xq8c-2rwf-x842CGA-xrfq-jrm8-pmjrCGA-xw2w-f755-v93pCGA-xx9r-hw7p-58c5CGA-xxhr-gx23-53mqCGA-29gj-637w-c66mCGA-3q43-qgq4-jr3cCGA-4382-cprr-4p6jCGA-pp4h-hq3q-3q7wCGA-qr2g-87pj-73r6CGA-r36m-xhj3-2g2qCGA-rv79-7f3w-9vxwCGA-3vrj-3g29-fw3jCGA-4m66-mpmf-5rxcCGA-5qhc-9gc2-6m48CGA-c57c-7mq5-6r5mCGA-f93v-mjv4-6hh3CGA-j26q-rx3c-3gv3CGA-p983-jhhx-59vcCGA-r8r6-gqwv-qj64CGA-rm89-9mp4-j73pCGA-rqm9-w46c-3pfjCGA-v8jj-jrr6-4738CGA-vfr6-wjj8-cphfCGA-xj7x-g2jc-vxfhCGA-29q4-5mwr-qcw5CGA-2r75-x6fc-rgp3CGA-4mgv-wc55-hxqrCGA-5fqx-xm6r-f9wmCGA-7qf7-rpqm-cx9mCGA-86p9-3334-qx49CGA-8fvg-3m83-cx9fCGA-8rqh-5j4c-xpvfCGA-9fc5-w658-jrhxCGA-cfw9-hjwp-x6m3CGA-g743-964x-83xqCGA-g9p3-j2rx-69qqCGA-jr88-p4qc-v9cvCGA-mf74-hp5m-74vfCGA-p6jc-244w-fgc2CGA-p9fg-c9m8-pm3wCGA-qgmh-6q9g-8gfcCGA-rjpm-fc44-gc5mCGA-x387-9xxm-gj22CGA-x7hg-jvcq-9h5h
Advisory lineage Upstream: 0 Downstream: 8
Awaiting Analysis
Published: 15 Apr 2026, 08:59
Last modified:18 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.53% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2026, 08:59
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber
  • v4.0•MEDIUM•Score: 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber
  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber
  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.53%• Percentile: 44%

Techniques & Countermeasures

  • CWE-90•Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

    The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Affected Systems

  • chainguard•apache-hop

    < 2.17.0-r9

  • chainguard•apache-nifi

    < 2.9.0-r0 | < 2.9.0-r3

  • chainguard•apache-nifi-registry

    < 2.9.0-r3

  • chainguard•apache-nifi-registry-toolkit

    < 2.9.0-r3

  • chainguard•apache-pulsar-4.0

    < 4.0.10-r0

  • chainguard•apache-pulsar-4.1

    all

  • chainguard•apache-pulsar-4.2

    < 4.2.1-r0

  • chainguard•camunda-8.8

    < 8.8.22-r2

  • chainguard•camunda-8.9

    < 8.9.1-r0

  • chainguard•camunda-zeebe-8.6

    all

  • chainguard•camunda-zeebe-8.7

    < 8.7.28-r0

  • chainguard•camunda-zeebe-8.8

    < 8.8.23-r0

  • chainguard•camunda-zeebe-8.9

    < 8.9.1-r0

  • chainguard•commercial-elasticsearch-8.17

    all

  • chainguard•commercial-elasticsearch-8.18

    all

  • chainguard•commercial-elasticsearch-8.19

    < 8.19.15-r0

  • chainguard•commercial-elasticsearch-9.0

    all

  • chainguard•commercial-elasticsearch-9.1

    all

  • chainguard•commercial-elasticsearch-9.2

    all

  • chainguard•commercial-elasticsearch-9.3

    < 9.3.5-r0

  • chainguard•druid

    < 36.0.0-r15

  • chainguard•eco-java-gradle-7.6.5

    all

  • chainguard•eco-java-gradle-7.6.6

    all

  • chainguard•eco-java-gradle-8.10

    all

  • chainguard•eco-java-gradle-8.10.1

    all

  • chainguard•eco-java-gradle-8.10.2

    all

  • chainguard•eco-java-gradle-8.11

    all

  • chainguard•eco-java-gradle-8.11.1

    all

  • chainguard•eco-java-gradle-8.12

    all

  • chainguard•eco-java-gradle-8.12.1

    all

  • chainguard•eco-java-gradle-8.13

    all

  • chainguard•eco-java-gradle-8.14

    all

  • chainguard•eco-java-gradle-8.14.1

    all

  • chainguard•eco-java-gradle-8.14.2

    all

  • chainguard•eco-java-gradle-8.14.3

    all

  • chainguard•eco-java-gradle-8.14.4

    all

  • chainguard•eco-java-gradle-8.8

    all

  • chainguard•eco-java-gradle-8.9

    all

  • chainguard•eco-java-gradle-9.0.0

    all

  • chainguard•eco-java-gradle-9.1.0

    all

  • chainguard•eco-java-gradle-9.2.0

    all

  • chainguard•eco-java-gradle-9.2.1

    all

  • chainguard•eco-java-gradle-9.3.0

    all

  • chainguard•eco-java-gradle-9.3.1

    all

  • chainguard•eco-java-gradle-9.4.0

    all

  • chainguard•eco-java-gradle-9.4.1

    all

  • chainguard•elasticsearch-7

    < 7.17.29-r12

  • chainguard•elasticsearch-7-iamguarded

    < 7.17.29-r12

  • chainguard•elasticsearch-8.17

    < 8.17.10-r21

  • chainguard•elasticsearch-8.18

    all

Showing first 50 affected entries in server-rendered view.

References (36)