~ / search / GHSA-c3fc-8qff-9hwx

GHSA-c3fc-8qff-9hwx

Bouncy Castle has an LDAP injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-0636

Packages

EcosystemPackageAffectedFixed in
Maven org.bouncycastle:bcprov-jdk14 >= 1.74, < 1.80.2 1.80.2
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.74, < 1.80.2 1.80.2
Maven org.bouncycastle:bcprov-jdk18on >= 1.74, < 1.80.2 1.80.2
Maven org.bouncycastle:bcprov-jdk14 >= 1.81, < 1.81.1 1.81.1
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.81, < 1.81.1 1.81.1
Maven org.bouncycastle:bcprov-jdk18on >= 1.81, < 1.81.1 1.81.1
Maven org.bouncycastle:bcprov-jdk14 >= 1.82, < 1.84 1.84
Maven org.bouncycastle:bcprov-jdk15to18 >= 1.82, < 1.84 1.84
Maven org.bouncycastle:bcprov-jdk18on >= 1.82, < 1.84 1.84

Details

As written in the advisory (Markdown source, shown as plain text).

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. Issue affecting: BC 1.74 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83. Fixed versions: BC 1.80.2, BC 1.81.1, BC 1.84

References

External links from the advisory. They lead to third-party sites.