android-backup-extractor

Android backup extractor Utility to extract and repack Android backups created with adb backup ICS+. Largely based on BackupManagerService.java from AOSP. Building Requires Java 11. Handling encrypted backups requires the JCE unlimited strength jurisdiction policy not needed if using current Java...

CVE-2026-18040

A flaw was found in Bouncy Castle. The Hamming Quasi-Cyclic HQC cryptographic algorithm leaks secret data through memory cache access patterns and execution timing variations during key encapsulation and decapsulation operations. A local attacker capable of monitoring cache activity or measuring...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 IF1 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the...

CLEANSTART-2026-TA59206 In Bouncy Castle for Java before 1

CVE-2026-97873 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-MV07927 In Bouncy Castle for Java before 1

CVE-2026-18040 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-KF30791 In Bouncy Castle for Java before 1

CVE-2026-71891 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-HE64068 In Bouncy Castle for Java before 1

CVE-2026-71892 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-MO96891 In Bouncy Castle for Java before 1

CVE-2026-17508 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-LI97281 In Bouncy Castle for Java before 1

CVE-2026-71889 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-NB89107 In Bouncy Castle for Java before 1

CVE-2026-18036 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-RU76121 In Bouncy Castle for Java before 1

CVE-2026-85515 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-EM43415 In Bouncy Castle for Java before 1

CVE-2026-71888 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CVE-2026-71886

A flaw was found in Bouncy Castle. The OpenPGP certificate application programming interface API fails to verify whether a subkey possesses certification authority before validating third-party certifications or trust delegations. An attacker in possession of a restricted signing or encryption...

CVE-2026-71889

A flaw was found in Bouncy Castle. The certificate path reviewer PKIXCertPathReviewer fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.327 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries

Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Apache Log4j is vulnerable to an improper encoding or escaping of output vulnerability CVE-2026-49844; FasterXML jackson-databind is vulnerable to multiple uncontrolled resource consumption,...

bouncy-castle-generative-test-poc

Generative testing bouncy castle vulnerability CVE-2020-28052 Running the tests Test the vulnerable versions defaults to 1.66 $ clojure -M:test $ clojure -M:test:v1.65 Test the versions before the vuln and after the patch 1.67 $ clojure -M:test:v1.64 $ clojure -M:test:patched Links...

CVE-2026-71888

A flaw was found in Bouncy Castle. In its Cryptographic Message Syntax CMS streaming parser, messages with mismatched attribute and algorithm fields are improperly handled, allowing attributes to be returned as valid even though they were not protected by the Message Authentication Code MAC. A...

CVE-2026-97873

A flaw was found in Bouncy Castle. In its legacy password-based encryption implementations, iteration counts parsed from untrusted cryptographic inputs are processed without enforcing an upper limit. A remote attacker could exploit this vulnerability by supplying crafted parameters with an...

CVE-2026-71884

A flaw was found in Bouncy Castle. The native one-shot Counter CTR mode cipher fails to verify that the input data length fits within the counter space defined by the initialization vector. When processing overly long inputs, the counter wraps around and causes the keystream to repeat. This flaw...