| Bouncy Castle has an LDAP injectionCVE-2026-0636 · GHSA-C3FC-8QFF-9HWX |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15to18 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle Has Covert Timing Channel VulnerabilityCVE-2026-5598 · GHSA-P93R-85WP-75V3 |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15to18 |
MavenRed Hat |
High
|
Fix reported |
|
| Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocksCVE-2025-14813 · GHSA-574F-3G2M-X479 |
org.bouncycastle:bcprov-debug-jdk14org.bouncycastle:bcprov-debug-jdk15on |
MavenRed Hat |
Critical
|
Fix reported |
|
| Bouncy Castle for Java on All (API modules) allows Excessive AllocationCVE-2025-8885 · GHSA-67MF-3CR5-8W23 |
org.bouncycastle:bc-fipsorg.bouncycastle:bcprov-jdk14 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle crafted signature and public key can be used to trigger an infinite loopCVE-2024-30172 · GHSA-M44J-CFRM-G8QC |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15to18 |
MavenNuGetRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")CVE-2024-30171 · GHSA-V435-XC8X-WVR9 |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15on |
MavenNuGetRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle Java Cryptography API vulnerable to DNS poisoningCVE-2024-34447 · GHSA-4H8F-2WVX-GG5W |
org.bouncycastle:bcprov-jdk12org.bouncycastle:bcprov-jdk14 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle Denial of Service (DoS)CVE-2023-33202 · GHSA-WJXJ-5M7G-MG7Q |
org.bouncycastle:bcpkix-jdk18onorg.bouncycastle:bcprov-ext-jdk15on |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle For Java LDAP injection vulnerabilityCVE-2023-33201 · GHSA-HR8G-6V94-X4M9 |
org.bouncycastle:bcprov-debug-jdk14org.bouncycastle:bcprov-debug-jdk15on |
MavenRed Hat |
Medium
|
Fix reported |
|
| Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.CVE-2024-29857 · GHSA-8XFC-GM6G-VGPV |
org.bouncycastle:bc-fipsorg.bouncycastle:bcprov-jdk14 |
MavenNuGetRed Hat |
Medium
|
Fix reported |
|
| Timing based private key exposure in Bouncy CastleCVE-2020-15522 · GHSA-6XX3-RG99-GC3P |
org.bouncycastle:bc-fipsorg.bouncycastle:bcprov-ext-jdk15on |
MavenNuGetRed Hat |
Medium
|
Fix reported |
|
| In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB modeCVE-2016-1000344 · GHSA-2J2X-HX4G-2GF4 |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
High
|
Fix reported |
|
| Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2015-7940 · GHSA-4MV7-CQ75-3QJM |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
Medium
|
Fix reported |
|
| In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validateCVE-2016-1000338 · GHSA-4VHJ-98R6-424H |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
High
|
Fix reported |
|
| The Bouncy Castle JCE Provider carry a propagation bugCVE-2016-1000340 · GHSA-R97X-3G8F-GX3M |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
High
|
Fix reported |
|
| In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB modeCVE-2016-1000352 · GHSA-W285-WF9Q-5W69 |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
High
|
Fix reported |
|
| In Bouncy Castle JCE Provider the other party DH public key is not fully validatedCVE-2016-1000346 · GHSA-FJQM-246C-MWQG |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
Low
|
Fix reported |
|
| Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2016-1000339 · GHSA-C8XF-M4FF-JCXJ |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15CVE-2016-1000345 · GHSA-9GP4-QRFF-C648 |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
Medium
|
Fix reported |
|
| In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default valuesCVE-2016-1000343 · GHSA-RRVX-PWF8-P59P |
org.bouncycastle:bcprov-jdk14org.bouncycastle:bcprov-jdk15 |
MavenRed Hat |
High
|
Fix reported |
|
