Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.bouncycastle/bctls-fips@1.0.17
purl pkg:maven/org.bouncycastle/bctls-fips@1.0.17
Next non-vulnerable version 1.0.24
Latest non-vulnerable version 2.1.24
Risk score 2.6
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
GHSA-4h8f-2wvx-gg5w
Aliases:
CVE-2024-34447
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning An issue was discovered in the Bouncy Castle Crypto Package For …
1.0.19
Vulnerable
GHSA-v435-xc8x-wvr9
Aliases:
CVE-2024-30171
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") An issue was discovered in Bouncy Castle …
1.0.19
Vulnerable
1.0.19
Vulnerable
CVE-2026-14682

Possible OOM from unbounded up-front allocation on a definite-length read Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 …
1.0.24
Not vulnerable
CVE-2026-59638

JSSE hostname verifier CN-fallback enabled by default despite documented opt-in Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 …
1.0.24
Not vulnerable
2.0.24
Not vulnerable
2.1.24
Not vulnerable
CVE-2026-59646

DTLS handshake reassembler allocates buffer from unchecked 24-bit length Affects Bouncy Castle for Java FIPS (BC-FJA) bctls-fips before 1.0.24 (1.0.X …
1.0.24
Not vulnerable
2.0.24
Not vulnerable
2.1.24
Not vulnerable
This package is not known to fix any advisories.