367 matches found
CVE-2026-18036: Observable Timing Discrepancy
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...
PT-2026-104155
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...
CVE-2026-17508: Allocation of Resources Without Limits or Throttling
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...
Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars
Summary IBM webMethods Integration Sever uses third party Bouncy Castle for Java FIPS jars that are affected by multiple CVEs. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X...
Improper Signature Verification
Bouncy Castle for Java is vulnerable to Improper Signature Verification. The vulnerability is due to CMS.verifySignatures returning true for SignedData objects containing no signers, which allows an attacker to bypass signature verification and have unsigned data incorrectly treated as successful...
Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities in Bouncy Castle for Java
Summary TSSC/IMC addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle f...
Uncontrolled Resource Consumption
Bouncy Castle for Java is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded iteration counts in CRMF/CMP password-MAC processing, which allows an attacker to supply a maliciously high iteration count and cause excessive resource consumption, potentially...
CLEANSTART-2026-VS62795 In Bouncy Castle for Java before 1
CVE-2026-58062 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-EW82020 In Bouncy Castle for Java before 1
Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...
CLEANSTART-2026-XR16357 In Bouncy Castle for Java before 1
CVE-2026-59650 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-XM48481 In Bouncy Castle for Java before 1
CVE-2026-59651 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-JP93433 In Bouncy Castle for Java before 1
Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...
CLEANSTART-2026-WM89566 In Bouncy Castle for Java before 1
CVE-2026-58063 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-MQ87842 In Bouncy Castle for Java before 1
Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...
CLEANSTART-2026-TK63612 In Bouncy Castle for Java before 1
Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...
CLEANSTART-2026-KK18805 In Bouncy Castle for Java before 1
CVE-2026-58059 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-ZQ08771 In Bouncy Castle for Java before 1
CVE-2026-58060 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-QN59512 In Bouncy Castle for Java before 1
CVE-2026-58061 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...