CVE-20XX-?

Bouncycastle bc-java CVEs.

Published CVEs affecting Bouncycastle bc-java, ranked by exploit odds.

34 CVEs · updated 2026-11-06 02:16 UTC

  1. CVE-2026-58060

    In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.6% exploit odds Fix listed
  2. CVE-2026-13586

    In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Denial of service Bouncycastle bc-java

    5.3 MEDIUM 0.6% exploit odds Fix listed
  3. CVE-2026-59644

    In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

    Denial of service Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  4. CVE-2026-59649

    In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  5. CVE-2026-58059

    In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  6. CVE-2026-12852

    In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

    Other Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  7. CVE-2026-13506

    In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Denial of service Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  8. CVE-2026-14682

    In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

    Other Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  9. CVE-2026-59646

    In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.5% exploit odds Fix listed
  10. CVE-2024-14041

    In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.

    Other Bouncycastle bc-java

    8.2 HIGH 0.5% exploit odds Fix listed
  11. CVE-2026-8763

    In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Crypto Bouncycastle bc-java

    9.3 CRITICAL 0.4% exploit odds Fix listed
  12. CVE-2026-59647

    In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

    Denial of service Bouncycastle bc-java

    6.9 MEDIUM 0.4% exploit odds Fix listed
  13. CVE-2026-59648

    In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

    Denial of service Bouncycastle bc-java

    6.9 MEDIUM 0.4% exploit odds Fix listed
  14. CVE-2026-58063

    In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Denial of service Bouncycastle bc-java

    5.3 MEDIUM 0.4% exploit odds Fix listed
  15. CVE-2026-17507

    In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.

    Other Bouncycastle bc-java

    8.7 HIGH 0.4% exploit odds Fix listed
  16. CVE-2026-59645

    In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

    Denial of service Library Bouncycastle bc-java

    8.7 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-58062

    In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Crypto Bouncycastle bc-java

    9.3 CRITICAL 0.4% exploit odds Fix listed
  18. CVE-2026-59640

    In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.3% exploit odds Fix listed
  19. CVE-2026-59638

    In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

    Other Bouncycastle bc-java

    9.3 CRITICAL 0.3% exploit odds Fix listed
  20. CVE-2026-15055

    In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

    Denial of service Bouncycastle bc-java

    5.3 MEDIUM 0.3% exploit odds Fix listed
  21. CVE-2026-59650

    In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Other Bouncycastle bc-java

    9.3 CRITICAL 0.3% exploit odds Fix listed
  22. CVE-2026-59642

    In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

    Other Web app Bouncycastle bc-java

    8.7 HIGH 0.3% exploit odds Fix listed
  23. CVE-2026-59652

    In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

    Injection Bouncycastle bc-java

    6.9 MEDIUM 0.3% exploit odds Fix listed
  24. CVE-2026-12185

    In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Other Bouncycastle bc-java

    7.1 HIGH 0.3% exploit odds Fix listed
  25. CVE-2026-58061

    In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.3% exploit odds Fix listed
  26. CVE-2026-59639

    In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

    Crypto Web app Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  27. CVE-2026-59643

    In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

    Crypto Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  28. CVE-2026-12803

    In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Other Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  29. CVE-2026-59651

    In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Crypto Bouncycastle bc-java

    7.1 HIGH 0.2% exploit odds Fix listed
  30. CVE-2026-12802

    In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

    Other Web app Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  31. CVE-2026-59641

    In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  32. CVE-2026-12816

    In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Other Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  33. CVE-2026-12860

    In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

    Crypto Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed
  34. CVE-2026-12817

    In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

    Other Bouncycastle bc-java

    8.7 HIGH 0.2% exploit odds Fix listed

All CVEs affecting Bouncycastle bc-java that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.