Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.bouncycastle/bcprov-jdk14/CVE-2026-59652
Advisory ID gitlab/maven/org.bouncycastle/bcprov-jdk14/CVE-2026-59652
Aliases CVE-2026-59652
Summary LDAP filter injection in legacy jdk1.4 LDAPStoreHelper Affects Bouncy Castle for Java before 1.85. The escaping added for CVE-2023-33201 and CVE-2026-0636 reached the main Java sources and the jdk1.4 X509LDAPCertStoreSpi but not the jdk1.4 LDAPStoreHelper, whose parseDN() returns an unescaped DN component that callers concatenate into an LDAP filter. Because the jdk1.4 build replaces the patched file with this variant, bcprov-jdk14 never received the fix. A certificate with crafted CN characters can splice extra clauses into the filter passed to the directory search.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-jdk14/CVE-2026-59652.yml
Reference id Reference type URL
27c468af54ee6c6af87eab5a3a8468dce17e24a0 Other https://github.com/bcgit/bc-java/commit/27c468af54ee6c6af87eab5a3a8468dce17e24a0
CVE-2026-59652 https://github.com/bcgit/bc-java/wiki/CVE-2026-59652
CVE-2026-59652 https://nvd.nist.gov/vuln/detail/CVE-2026-59652
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-jdk14/CVE-2026-59652.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.