Legion Of The Bouncy Castle Inc Bc-Fja vulnerabilities
27 known vulnerabilities affecting legion_of_the_bouncy_castle_inc/bc-fja.
Total CVEs
27
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH17MEDIUM8
Vulnerabilities
Page 2 of 2
CVE-2026-59638P3MEDIUMCVSS 6.5≥ 1.0.7, < 1.0.24≥ 2.0.0, < 2.0.24+1 more2026-08-03
CVE-2026-59638 [MEDIUM] CWE-297 CVE-2026-59638: In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
nvd
CVE-2026-58063P4MEDIUMCVSS 5.3≥ 1.0.0, < 1.0.2.7≥ 2.0.0, < 2.0.2+1 more2026-08-03
CVE-2026-58063 [MEDIUM] CWE-770 CVE-2026-58063: In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
nvd
CVE-2026-59648P4MEDIUMCVSS 5.3≥ 1.0.6, < 1.0.13≥ 2.0.0, < 2.0.13+1 more2026-08-03
CVE-2026-59648 [MEDIUM] CWE-770 CVE-2026-59648: In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes.
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
nvd
CVE-2026-59647P4MEDIUMCVSS 5.3≥ 1.0.0, < 1.0.12≥ 2.0.0, < 2.0.12+1 more2026-08-03
CVE-2026-59647 [MEDIUM] CWE-770 CVE-2026-59647: In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This
In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
nvd
CVE-2026-59640P4MEDIUMCVSS 5.3≥ 1.0.0, < 1.0.13≥ 2.0.0, < 2.0.13+1 more2026-08-03
CVE-2026-59640 [MEDIUM] CWE-203 CVE-2026-59640: In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-ke
In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
nvd
CVE-2026-59641P4MEDIUMCVSS 5.3≥ 1.0.0, < 1.0.7≥ 2.0.0, < 2.0.7+2 more2026-08-03
CVE-2026-59641 [MEDIUM] CWE-345 CVE-2026-59641: In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
nvd
CVE-2026-8149P4MEDIUMCVSS 5.1≥ 2.1.0, < 2.1.32026-05-08
CVE-2026-8149 [MEDIUM] CWE-1068 CVE-2026-8149: A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, L
A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. BC-FJA bc-fips on Linux, X86_64, AVX, AVX-512f.
This vulnerability is associated with program files gcm128w, gcm512w, gcm128w.C, gcm512w.C.
This issue affects BC-LTS: from 2.73.0 before 2.73.11; BC-FJA: from 2.
nvd
← Previous2 / 2