Search for packages
| purl | pkg:maven/org.bouncycastle/bcprov-jdk14@1.49 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-4mv7-cq75-3qjm
Aliases: CVE-2015-7940 |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 The Bouncy Castle Java library before 1.51 does not validate a point … |
Vulnerable |
|
GHSA-4vhj-98r6-424h
Aliases: CVE-2016-1000338 |
In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and … |
Vulnerable |
|
GHSA-72m5-fvvv-55m6
Aliases: CVE-2020-26939 |
Observable Differences in Behavior to Error Inputs in Bouncy Castle In Legion of the Bouncy Castle BC before 1.55 and … |
Vulnerable |
|
GHSA-6xx3-rg99-gc3p
Aliases: CVE-2020-15522 |
Timing based private key exposure in Bouncy Castle Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA … | There are no reported fixed by versions. |
|
GHSA-67mf-3cr5-8w23
Aliases: CVE-2025-8885 |
Bouncy Castle for Java on All (API modules) allows Excessive Allocation A resource allocation vulnerability exists in Bouncy Castle for … |
Vulnerable |
|
GHSA-hr8g-6v94-x4m9
Aliases: CVE-2023-33201 |
Bouncy Castle For Java LDAP injection vulnerability Bouncy Castle provides the `X509LDAPCertStoreSpi.java` class which can be used in conjunction with … |
Vulnerable |
|
GHSA-r9ch-m4fh-fc7q
Aliases: CVE-2016-1000341 |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature … |
Vulnerable Vulnerable |
|
GHSA-qcj7-g2j5-g7r3
Aliases: CVE-2016-1000342 |
In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification In the Bouncy Castle … |
Vulnerable Vulnerable |
|
GHSA-2j2x-hx4g-2gf4
Aliases: CVE-2016-1000344 |
In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode In the Bouncy Castle JCE Provider … |
Vulnerable Vulnerable |
|
GHSA-fjqm-246c-mwqg
Aliases: CVE-2016-1000346 |
In Bouncy Castle JCE Provider the other party DH public key is not fully validated In the Bouncy Castle JCE … |
Vulnerable Vulnerable |
|
GHSA-rrvx-pwf8-p59p
Aliases: CVE-2016-1000343 |
In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values … |
Vulnerable Vulnerable |
|
GHSA-c8xf-m4ff-jcxj
Aliases: CVE-2016-1000339 |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier the primary … |
Vulnerable Vulnerable |
|
GHSA-xqj7-j8j5-f2xr
Aliases: CVE-2018-1000180 |
Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator Bouncy Castle BC 1.54 - 1.59, … |
Vulnerable Vulnerable |
|
GHSA-9gp4-qrff-c648
Aliases: CVE-2016-1000345 |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES … |
Vulnerable Vulnerable |
|
GHSA-w285-wf9q-5w69
Aliases: CVE-2016-1000352 |
In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode In the Bouncy Castle JCE Provider … |
Vulnerable Vulnerable |
|
CVE-2018-1000613
Aliases: GHSA-4446-656p-f54g |
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 … |
Vulnerable Vulnerable |
|
CVE-2023-33201
Aliases: GHSA-hr8g-6v94-x4m9 |
Improper Certificate Validation Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects … |
Vulnerable Vulnerable |
|
GHSA-v435-xc8x-wvr9
Aliases: CVE-2024-30171 |
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") An issue was discovered in Bouncy Castle … |
Vulnerable Vulnerable |
|
GHSA-8xfc-gm6g-vgpv
Aliases: CVE-2024-29857 |
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. An issue was discovered in ECCurve.java and ECCurve.cs … |
Vulnerable Vulnerable |
|
GHSA-wjxj-5m7g-mg7q
Aliases: CVE-2023-33202 |
Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue … |
Vulnerable Vulnerable |
|
CVE-2026-14682
|
Possible OOM from unbounded up-front allocation on a definite-length read Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing … | There are no reported fixed by versions. |
|
CVE-2026-12803
|
KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) Affects Bouncy Castle for Java before 1.85. … | There are no reported fixed by versions. |
|
CVE-2026-12185
|
BKS/UBER keystore allocates from untrusted lengths before integrity check Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore … | There are no reported fixed by versions. |
|
CVE-2026-59650
|
MTI/A0 DH agreement exponentiates unvalidated peer value Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, … | There are no reported fixed by versions. |
|
CVE-2026-58061
|
CCM-family modes write plaintext to caller buffer before tag check Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the … | There are no reported fixed by versions. |
|
CVE-2026-13506
|
Lazy ASN.1 sequence forcing resets nesting-depth guard Affects Bouncy Castle for Java before 1.85. LazyEncodedSequence.force() parses the deferred SEQUENCE with … | There are no reported fixed by versions. |
|
CVE-2026-59651
|
BKS keystore accepts legacy version with 16-bit integrity MAC key Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore … | There are no reported fixed by versions. |
|
CVE-2026-8763
|
Name Constraints bypass via trailing dot in rfc822Name and URI Affects Bouncy Castle for Java before 1.85. PKIXNameConstraintValidator strips a … | There are no reported fixed by versions. |
|
CVE-2026-13586
|
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC … | There are no reported fixed by versions. |
|
CVE-2026-12816
|
IESEngine stream-mode MAC forgery via length-dependent KDF split Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without … | There are no reported fixed by versions. |
|
CVE-2026-59652
|
LDAP filter injection in legacy jdk1.4 LDAPStoreHelper Affects Bouncy Castle for Java before 1.85. The escaping added for CVE-2023-33201 and … | There are no reported fixed by versions. |
|
CVE-2026-12860
|
RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes … | There are no reported fixed by versions. |
|
CVE-2026-58059
|
Quadratic-time escaping when stringifying X.500 distinguished names Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting … | There are no reported fixed by versions. |
|
CVE-2026-58063
|
BCFKS keystore load honours unbounded KDF cost from untrusted file Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the … | There are no reported fixed by versions. |