Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.bouncycastle/bcprov-jdk15on@1.38
purl pkg:maven/org.bouncycastle/bcprov-jdk15on@1.38
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-jua2-2byr-t3cv
Aliases:
CVE-2016-1000338
GHSA-4vhj-98r6-424h
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
1.56
Affected by 6 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T15:56:54.043288+00:00 GHSA Importer Affected by VCID-jua2-2byr-t3cv https://github.com/advisories/GHSA-4vhj-98r6-424h 38.0.0
2026-04-01T12:48:03.385770+00:00 GitLab Importer Affected by VCID-jua2-2byr-t3cv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-jdk15on/CVE-2016-1000338.yml 38.0.0