CVE Intelligence

Bouncycastle Bc-java vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Bouncycastle Bc-java: 34 record(s), with affected versions and fixes.
cpe:2.3:a:bouncycastle:bc-java

CVE-2026-59643 High · 7.5 CWE-347 Aug 2, 2026
OpenPGP inline-signature policy failures silently ignored
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.
CVE-2026-59642 High · 7.5 CWE-354 Aug 2, 2026
CMS AuthenticatedData content not bound to MAC when authAttrs present
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
CVE-2026-59641 Medium · 5.3 CWE-345 Aug 2, 2026
S/MIME validator trusts signer-asserted signingTime for path validation
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
CVE-2026-59640 Medium · 5.3 CWE-203 Aug 2, 2026
OpenPGP CFB quick-check oracle active on symmetric/session-key paths
In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
CVE-2026-59639 High · 7.5 CWE-347 Aug 2, 2026
CMS verifySignatures returns true for SignedData with zero signers
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
CVE-2026-59638 Medium · 6.5 CWE-297 Aug 2, 2026
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
CVE-2026-15055 High · 8.2 CWE-770 Aug 2, 2026
PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
CVE-2026-12185 High · 8.6 CWE-789 Aug 2, 2026
BKS/UBER keystore allocates from untrusted lengths before integrity check
In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
CVE-2024-14041 Medium · 5.9 CWE-208 Jul 28, 2026
ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.