https://vulnogram.org/ Most recent CVEs assigned by Legion of the Bouncy Castle Inc. (bcorg). https://vulnogram.org/seaview/icons/bcorg.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-71884 https://vulnogram.org/CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 t… High Network Exploitable Fri, 09 Oct 2026 09:30:50 GMT https://vulnogram.org/CVE-2026-71890 https://vulnogram.org/CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never es… High Network Exploitable Sat, 03 Oct 2026 08:57:00 GMT https://vulnogram.org/CVE-2026-71891 https://vulnogram.org/CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a forei… High Network Exploitable Sat, 03 Oct 2026 08:56:01 GMT https://vulnogram.org/CVE-2026-18040 https://vulnogram.org/CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight suppor… Medium Sat, 03 Oct 2026 08:55:06 GMT https://vulnogram.org/CVE-2026-71885 https://vulnogram.org/CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the l… Critical Network Exploitable Sat, 03 Oct 2026 08:51:53 GMT https://vulnogram.org/CVE-2026-71886 https://vulnogram.org/CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the author… High Network Exploitable Sat, 03 Oct 2026 08:46:33 GMT https://vulnogram.org/CVE-2026-71887 https://vulnogram.org/CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that bindin… High Network Exploitable Sat, 03 Oct 2026 08:39:07 GMT https://vulnogram.org/CVE-2026-71883 https://vulnogram.org/CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which c… High Network Exploitable Sat, 03 Oct 2026 08:38:18 GMT https://vulnogram.org/CVE-2026-71888 https://vulnogram.org/CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring… High Network Exploitable Sat, 03 Oct 2026 08:36:12 GMT https://vulnogram.org/CVE-2026-71889 https://vulnogram.org/CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate.… High Network Exploitable Sat, 03 Oct 2026 08:31:01 GMT https://vulnogram.org/CVE-2026-71892 https://vulnogram.org/CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true), never ran for a message using RFC 9709 content-encryption key derivati… Medium Network Exploitable Sat, 03 Oct 2026 08:30:26 GMT https://vulnogram.org/CVE-2026-85515 https://vulnogram.org/CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cl… High Network Exploitable Sat, 03 Oct 2026 08:05:16 GMT https://vulnogram.org/CVE-2026-97873 https://vulnogram.org/CVE-2026-97873 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input cou… Medium Network Exploitable Sat, 03 Oct 2026 08:04:43 GMT https://vulnogram.org/CVE-2026-18036 https://vulnogram.org/CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on t… High Network Exploitable Fri, 02 Oct 2026 07:54:16 GMT https://vulnogram.org/CVE-2026-17508 https://vulnogram.org/CVE-2026-17508 In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of wo… Medium Network Exploitable Fri, 02 Oct 2026 07:27:59 GMT https://vulnogram.org/CVE-2026-17507 https://vulnogram.org/CVE-2026-17507 In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malf… High Network Exploitable Fri, 02 Oct 2026 07:26:34 GMT https://vulnogram.org/CVE-2026-103604 https://vulnogram.org/CVE-2026-103604 Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial… High Network Exploitable Fri, 02 Oct 2026 07:11:04 GMT https://vulnogram.org/CVE-2026-103603 https://vulnogram.org/CVE-2026-103603 Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key… High Network Exploitable Fri, 02 Oct 2026 07:10:34 GMT https://vulnogram.org/CVE-2026-103602 https://vulnogram.org/CVE-2026-103602 Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accept… High Network Exploitable Fri, 02 Oct 2026 07:10:03 GMT https://vulnogram.org/CVE-2026-103601 https://vulnogram.org/CVE-2026-103601 Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via… High Network Exploitable Fri, 02 Oct 2026 07:09:17 GMT https://vulnogram.org/CVE-2026-103600 https://vulnogram.org/CVE-2026-103600 Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nes… High Network Exploitable Fri, 02 Oct 2026 07:08:51 GMT https://vulnogram.org/CVE-2026-63578 https://vulnogram.org/CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a P… High Network Exploitable Fri, 02 Oct 2026 07:08:15 GMT https://vulnogram.org/CVE-2026-63577 https://vulnogram.org/CVE-2026-63577 Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a… High Network Exploitable Fri, 02 Oct 2026 07:07:35 GMT https://vulnogram.org/CVE-2026-63576 https://vulnogram.org/CVE-2026-63576 Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName… High Network Exploitable Fri, 02 Oct 2026 07:07:02 GMT https://vulnogram.org/CVE-2026-63575 https://vulnogram.org/CVE-2026-63575 Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that u… High Network Exploitable Fri, 02 Oct 2026 07:06:31 GMT https://vulnogram.org/CVE-2026-63574 https://vulnogram.org/CVE-2026-63574 Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allo… High Network Exploitable Fri, 02 Oct 2026 07:06:00 GMT https://vulnogram.org/CVE-2026-63573 https://vulnogram.org/CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and wh… High Network Exploitable Fri, 02 Oct 2026 07:05:30 GMT https://vulnogram.org/CVE-2026-63572 https://vulnogram.org/CVE-2026-63572 Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file to cause a denial of service through CPU exhaustio… High Network Exploitable Fri, 02 Oct 2026 07:04:37 GMT https://vulnogram.org/CVE-2026-63571 https://vulnogram.org/CVE-2026-63571 Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have… High Network Exploitable Fri, 02 Oct 2026 07:04:17 GMT https://vulnogram.org/CVE-2026-63570 https://vulnogram.org/CVE-2026-63570 Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's cer… High Network Exploitable Fri, 02 Oct 2026 07:01:18 GMT https://vulnogram.org/CVE-2026-63569 https://vulnogram.org/CVE-2026-63569 Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already kn… Critical Network Exploitable Fri, 02 Oct 2026 07:00:23 GMT https://vulnogram.org/CVE-2026-63568 https://vulnogram.org/CVE-2026-63568 Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through C… High Network Exploitable Fri, 02 Oct 2026 06:59:30 GMT https://vulnogram.org/CVE-2026-63567 https://vulnogram.org/CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same ke… High Network Exploitable Fri, 02 Oct 2026 06:58:32 GMT https://vulnogram.org/CVE-2026-63566 https://vulnogram.org/CVE-2026-63566 Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated DTLS peer to cause a denial of service th… High Network Exploitable Fri, 02 Oct 2026 06:57:21 GMT https://vulnogram.org/CVE-2026-16001 https://vulnogram.org/CVE-2026-16001 Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has… High Network Exploitable Fri, 02 Oct 2026 06:55:36 GMT https://vulnogram.org/CVE-2026-16000 https://vulnogram.org/CVE-2026-16000 Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts wit… High Network Exploitable Fri, 02 Oct 2026 06:54:23 GMT https://vulnogram.org/CVE-2026-15999 https://vulnogram.org/CVE-2026-15999 Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via… High Network Exploitable Fri, 02 Oct 2026 06:52:16 GMT https://vulnogram.org/CVE-2026-13505 https://vulnogram.org/CVE-2026-13505 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt… High Network Exploitable Sat, 08 Aug 2026 00:59:40 GMT https://vulnogram.org/CVE-2026-8798 https://vulnogram.org/CVE-2026-8798 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding rou… High Network Exploitable Sat, 08 Aug 2026 00:50:56 GMT https://vulnogram.org/CVE-2026-13586 https://vulnogram.org/CVE-2026-13586 In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series),… Medium Network Exploitable Mon, 03 Aug 2026 02:58:00 GMT https://vulnogram.org/CVE-2026-13506 https://vulnogram.org/CVE-2026-13506 In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2… High Network Exploitable Mon, 03 Aug 2026 02:56:49 GMT https://vulnogram.org/CVE-2026-12860 https://vulnogram.org/CVE-2026-12860 In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12. High Network Exploitable Mon, 03 Aug 2026 02:55:58 GMT https://vulnogram.org/CVE-2026-12852 https://vulnogram.org/CVE-2026-12852 In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check. High Network Exploitable Mon, 03 Aug 2026 02:55:02 GMT https://vulnogram.org/CVE-2026-12817 https://vulnogram.org/CVE-2026-12817 In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series),… High Network Exploitable Mon, 03 Aug 2026 02:54:16 GMT https://vulnogram.org/CVE-2026-12816 https://vulnogram.org/CVE-2026-12816 In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. High Network Exploitable Mon, 03 Aug 2026 02:53:32 GMT https://vulnogram.org/CVE-2026-12803 https://vulnogram.org/CVE-2026-12803 In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12. High Network Exploitable Mon, 03 Aug 2026 02:52:20 GMT https://vulnogram.org/CVE-2026-12802 https://vulnogram.org/CVE-2026-12802 In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X serie… High Network Exploitable Mon, 03 Aug 2026 02:48:42 GMT https://vulnogram.org/CVE-2026-14682 https://vulnogram.org/CVE-2026-14682 In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.… High Network Exploitable Mon, 03 Aug 2026 02:44:13 GMT https://vulnogram.org/CVE-2026-58059 https://vulnogram.org/CVE-2026-58059 In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X seri… High Network Exploitable Mon, 03 Aug 2026 02:41:30 GMT https://vulnogram.org/CVE-2026-58060 https://vulnogram.org/CVE-2026-58060 In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X s… High Network Exploitable Mon, 03 Aug 2026 02:37:43 GMT