Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by bcorg

CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.java

Medium 6.5

In plain English

A medium-severity security flaw in BC-JAVA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 55.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bouncycastleno fix listedDEBIAN-CVE-2026-0636
Debian:13bouncycastleno fix listedDEBIAN-CVE-2026-0636
Debian:14bouncycastle1.86-1DEBIAN-CVE-2026-0636
Mavenorg.bouncycastle:bcprov-jdk141.84GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk141.80.2GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk141.81.1GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk15to181.84GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk15to181.80.2GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk15to181.81.1GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk18on1.84GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk18on1.81.1GHSA-c3fc-8qff-9hwx
Mavenorg.bouncycastle:bcprov-jdk18on1.80.2GHSA-c3fc-8qff-9hwx
Ubuntu:25.10bouncycastleno fix listedUBUNTU-CVE-2026-0636
Ubuntu:26.04:LTSbouncycastleno fix listedUBUNTU-CVE-2026-0636
Ubuntu:26.10bouncycastleno fix listedUBUNTU-CVE-2026-0636

Affected products (as reported)

VendorProductVersions
Legion of the Bouncy Castle Inc. BC-JAVA 1.74 – before 1.80.21.81 – before 1.81.11.82 – before 1.84

Weakness: CWE-90 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References