Bouncycastle

Bouncy Castle For Java Lts

28 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2026-59647

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:46:57
  • Zuletzt bearbeitet 28.08.2026 19:50:41

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0....

5.3

CVE-2026-59648

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:45:34
  • Zuletzt bearbeitet 28.08.2026 19:40:16

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2...

7.5

CVE-2026-59649

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:44:24
  • Zuletzt bearbeitet 02.09.2026 14:26:57

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X ...

9.1

CVE-2026-59650

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:42:46
  • Zuletzt bearbeitet 31.08.2026 18:07:14

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

7.5

CVE-2026-59651

  • EPSS 0.17%
  • Veröffentlicht 03.08.2026 00:41:23
  • Zuletzt bearbeitet 02.09.2026 14:24:53

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

8.6

CVE-2026-12185

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:38:01
  • Zuletzt bearbeitet 28.08.2026 14:42:59

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

9.1

CVE-2026-8763

  • EPSS 0.33%
  • Veröffentlicht 03.08.2026 00:36:05
  • Zuletzt bearbeitet 02.09.2026 14:28:48

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), ...

8.2

CVE-2026-15055

  • EPSS 0.26%
  • Veröffentlicht 03.08.2026 00:32:51
  • Zuletzt bearbeitet 28.08.2026 15:04:27

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series...