Legion of the Bouncy Castle Inc. BC Java

• CVE-2026-71890 High 8.7 MLS external commit can remove an arbitrary group member 0.2%
• CVE-2026-71891 High 7.1 BLS12-381 key validation accepts a public key built on a foreign curve 0.2%
• CVE-2026-18040 Medium 5.9 HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler 0.1%
• CVE-2026-71885 Critical 9.2 MLS X.509 credential not bound to the LeafNode signature key 0.2%
• CVE-2026-71886 High 8.2 OpenPGP certification accepted from a subkey without certification authority 0.2%
• CVE-2026-71887 High 8.2 OpenPGP data signature accepted from a signing subkey without cross-certification <0.1%
• CVE-2026-71888 High 8.7 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent 0.1%
• CVE-2026-71889 High 8.7 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate 0.2%
• CVE-2026-71892 Medium 6.9 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys 0.2%
• CVE-2026-85515 High 8.2 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check 0.2%
• CVE-2026-97873 Medium 5.3 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider 0.3%
• CVE-2026-18036 High 8.2 NTRU leaks private key information by reducing secret values with a non-constant-time integer division 0.3%
• CVE-2026-17508 Medium 5.3 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points 0.4%
• CVE-2026-17507 High 8.7 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender 0.4%
• CVE-2026-13586 Medium 5.3 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) 0.6%
• CVE-2026-13506 High 8.7 Lazy ASN.1 sequence forcing resets nesting-depth guard 0.5%
• CVE-2026-12860 High 8.7 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path 0.2%
• CVE-2026-12852 High 8.7 MLS wire decoder allocates attacker-declared opaque length before bounds check 0.5%
• CVE-2026-12817 High 8.7 OpenPGP AEAD decryption skips final tag on chunk-aligned data 0.2%
• CVE-2026-12816 High 8.7 IESEngine stream-mode MAC forgery via length-dependent KDF split 0.2%
• CVE-2026-12803 High 8.7 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) 0.2%
• CVE-2026-12802 High 8.7 CMS AuthEnvelopedData fails to enforce tag-length on decryption 0.2%
• CVE-2026-14682 High 8.7 Possible OOM from unbounded up-front allocation on a definite-length read 0.5%
• CVE-2026-58059 High 8.7 Quadratic-time escaping when stringifying X.500 distinguished names 0.5%
• CVE-2026-58060 High 8.7 HSS public-key level count unbounded, enabling huge allocation on verify 0.6%
• CVE-2026-58061 High 8.7 CCM-family modes write plaintext to caller buffer before tag check 0.3%
• CVE-2026-58062 Critical 9.3 Stapled OCSP response accepted without binding to the checked certificate 0.4%
• CVE-2026-58063 Medium 5.3 BCFKS keystore load honours unbounded KDF cost from untrusted file 0.4%
• CVE-2026-59638 Critical 9.3 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in 0.3%
• CVE-2026-59639 High 8.7 CMS verifySignatures returns true for SignedData with zero signers 0.2%
• CVE-2026-59640 High 8.7 OpenPGP CFB quick-check oracle active on symmetric/session-key paths 0.3%
• CVE-2026-59641 High 8.7 S/MIME validator trusts signer-asserted signingTime for path validation 0.2%
• CVE-2026-59642 High 8.7 CMS AuthenticatedData content not bound to MAC when authAttrs present 0.3%
• CVE-2026-59643 High 8.7 OpenPGP inline-signature policy failures silently ignored 0.2%
• CVE-2026-59644 High 8.7 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender 0.5%
• CVE-2026-59645 High 8.7 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema 0.4%
• CVE-2026-59646 High 8.7 DTLS handshake reassembler allocates buffer from unchecked 24-bit length 0.5%
• CVE-2026-59647 Medium 6.9 CRMF/CMP password-MAC honours unbounded iteration count 0.4%
• CVE-2026-59648 Medium 6.9 OpenPGP Argon2 S2K honours attacker-chosen memory and passes 0.4%
• CVE-2026-59649 High 8.7 OpenPGP user-attribute subpacket length bounded only by JVM max memory 0.5%
• CVE-2026-59650 Critical 9.3 MTI/A0 DH agreement exponentiates unvalidated peer value 0.3%
• CVE-2026-59651 High 7.1 BKS keystore accepts legacy version with 16-bit integrity MAC key 0.2%
• CVE-2026-59652 Medium 6.9 LDAP filter injection in legacy jdk1.4 LDAPStoreHelper 0.3%
• CVE-2026-12185 High 7.1 BKS/UBER keystore allocates from untrusted lengths before integrity check 0.3%
• CVE-2026-8763 Critical 9.3 Name Constraints bypass via trailing dot in rfc822Name and URI 0.4%
• CVE-2026-15055 Medium 5.3 PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input 0.3%
• CVE-2024-14041 High 8.2 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) 0.5%
• CVE-2026-3505 High 7.5 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. 0.8%
• CVE-2026-5588 High 7.5 PKIX draft CompositeVerifier accepts empty signature sequence as valid. 0.8%
• CVE-2026-5598 High 7.5 Non-constant time comparisons risk private key leakage in FrodoKEM. 0.9%