Legion of the Bouncy Castle vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IHigh 8.2 · Oct 9, 2026
• CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrHigh 8.2 · Oct 3, 2026
• CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPosHigh 7.1 · Oct 3, 2026
• CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachHigh 8.7 · Oct 3, 2026
• CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.High 8.7 · Oct 3, 2026
• CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about High 8.7 · Oct 3, 2026
• CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no eHigh 8.2 · Oct 3, 2026
• CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key ofHigh 8.2 · Oct 3, 2026
• CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_keCritical 9.2 · Oct 3, 2026
• CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and aHigh 8.2 · Oct 3, 2026
• CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc.High 7.1 · Oct 2, 2026
• CVE-2026-63577 Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc.High 8.2 · Oct 2, 2026
• CVE-2026-63576 Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc.High 8.2 · Oct 2, 2026
• CVE-2026-63575 Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc.High 7.1 · Oct 2, 2026
• CVE-2026-63574 Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSuHigh 8.7 · Oct 2, 2026
• CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc.High 8.2 · Oct 2, 2026
• CVE-2026-63572 Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc.High 7.1 · Oct 2, 2026
• CVE-2026-63571 Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) iHigh 8.7 · Oct 2, 2026
• CVE-2026-63570 Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc.High 7.1 · Oct 2, 2026
• CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately divisionHigh 8.2 · Oct 2, 2026
• CVE-2026-17507 In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with thHigh 8.7 · Oct 2, 2026
• CVE-2026-103604 Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy CasHigh 8.7 · Oct 2, 2026
• CVE-2026-103603 Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc.High 8.7 · Oct 2, 2026
• CVE-2026-103602 Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc.High 8.2 · Oct 2, 2026
• CVE-2026-103601 Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc.High 8.2 · Oct 2, 2026