Search for packages
| purl | pkg:maven/org.bouncycastle/bcpkix-jdk15to18@1.78 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 2.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-wg6q-6289-32hp
Aliases: CVE-2026-5588 |
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules : Use … |
Vulnerable |
|
CVE-2025-8916
Aliases: GHSA-4cx2-fc23-5wg6 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, … | There are no reported fixed by versions. |
|
CVE-2026-5588
Aliases: GHSA-wg6q-6289-32hp |
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules : Use … | There are no reported fixed by versions. |
|
GHSA-4cx2-fc23-5wg6
Aliases: CVE-2025-8916 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, … |
Vulnerable Vulnerable |
|
CVE-2026-59647
|
CRMF/CMP password-MAC honours unbounded iteration count Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling … | There are no reported fixed by versions. |
|
CVE-2026-13586
|
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC … | There are no reported fixed by versions. |
|
CVE-2026-59639
|
CMS verifySignatures returns true for SignedData with zero signers Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer … | There are no reported fixed by versions. |
|
CVE-2026-12802
|
CMS AuthEnvelopedData fails to enforce tag-length on decryption Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no … | There are no reported fixed by versions. |
|
CVE-2026-59642
|
CMS AuthenticatedData content not bound to MAC when authAttrs present Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the … | There are no reported fixed by versions. |
|
CVE-2026-15055
|
PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2024-30172
|
This advisory has been marked as False-Positive and removed An issue was discovered in Bouncy Castle Java Cryptography APIs before … |
GHSA-m44j-cfrm-g8qc
|
|
CVE-2024-30171
|
This advisory has been marked as False-Positive and removed An issue was discovered in Bouncy Castle Java TLS API and … |
GHSA-v435-xc8x-wvr9
|
|
CVE-2024-29857
|
This advisory has been marked as False-Positive and removed An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle … |
GHSA-8xfc-gm6g-vgpv
|