Search for packages
| purl | pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.71 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 2.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-wg6q-6289-32hp
Aliases: CVE-2026-5588 |
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules : Use … |
Vulnerable |
|
CVE-2025-8916
Aliases: GHSA-4cx2-fc23-5wg6 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, … | There are no reported fixed by versions. |
|
CVE-2026-5588
Aliases: GHSA-wg6q-6289-32hp |
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules : Use … | There are no reported fixed by versions. |
|
GHSA-4cx2-fc23-5wg6
Aliases: CVE-2025-8916 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, … |
Vulnerable Vulnerable |
|
GHSA-wjxj-5m7g-mg7q
Aliases: CVE-2023-33202 |
Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue … |
Vulnerable Vulnerable |
|
CVE-2026-59647
|
CRMF/CMP password-MAC honours unbounded iteration count Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling … | There are no reported fixed by versions. |
|
CVE-2026-13586
|
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC … | There are no reported fixed by versions. |
|
CVE-2026-59639
|
CMS verifySignatures returns true for SignedData with zero signers Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer … | There are no reported fixed by versions. |
|
CVE-2026-12802
|
CMS AuthEnvelopedData fails to enforce tag-length on decryption Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no … | There are no reported fixed by versions. |
|
CVE-2026-59642
|
CMS AuthenticatedData content not bound to MAC when authAttrs present Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the … | There are no reported fixed by versions. |
|
CVE-2026-15055
|
PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders … | There are no reported fixed by versions. |