CLEANSTART-2026-FV35085 Security fix for CVE-2026-0636 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, apache-nifi 1.25.0-r0, apache-nifi 2.9.0-r0, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.5-r0, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r1, kserve-modelmesh 0.12.0-r17, kserve-modelmesh 0.9.0-r1, logstash-fips 9.4.3-r1, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2, thingsboard 4.3.0.1-r2, wildfly 39.0.1-r0

CVE-2026-0636 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 (CVE-2026-0636)

Summary IBM® Db2® federated server is affected by a vulnerability in bcprov-jdk18on-1.82 CVE-2026-0636 Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Legion of the Bouncy Castle Inc. BC-JAV...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2), ca.denisab85:tn5250j (1.0.0) +127 more potentially affected by CVE-2026-0636 +1 more via org.bouncycastle:bcprov-jdk14 (>=1.38, <=1.84)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.p24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.restassuredpdfreport:com.github.lkkushan101.restassuredpdfreport 1.00 and more Source cves: CVE-2026-0636, CVE-2026-59652 Source advisory:...

com.walterjwhite.java.examples:ssh (0.0.17), com.walterjwhite.java.modules.linux-builder.modules.cli.providers:cdi (0.0.17) +24 more potentially affected by CVE-2026-0636 +1 more via org.bouncycastle:bcprov-ext-jdk14 (>=1.45, <=1.72)

org.bouncycastle:bcprov-ext-jdk14 MAVEN version =1.45, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-0636, CVE-2026-59652 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512808...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle [CVE-2025-14813] [CVE-2026-0636] [CVE-2026-5598]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle, due to flaws in BC-JAVA on all core modules. CVE-2025-14813 CVE-2026-0636 CVE-2026-5598. Bouncy castle BC-JAVA is used in our speech microservices. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in DataView. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA...

Security Bulletin: Multiple Security Vulnerabilities in third-Party libraries used by IBM Tivoli Netcool Configuration Manager

Summary Multiple vulnerabilities in the third-party Bouncy Castle libraries used by IBM Tivoli Netcool Configuration Manager have been addressed. Vulnerability Details CVEID:CVE-2026-5588 DESCRIPTION: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle In...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CVE-2026-0636)

Summary There are vulnerabilities in bcprov-jdk18on-1.83.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-0636. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-0636 DESCRIPTION: Improper neutralization of special elements used in an LDAP query 'LDAP...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.13.5 release and security update

Red Hat AMQ Broker 7.13.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

OPENSUSE-SU-2026:20627-1 Security update for bouncycastle

This update for bouncycastle fixes the following issues: - Update to version 1.84: - CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly bsc1262225. - CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java bsc1262226. - CVE-2026-3505: Unbounded PGP...

bouncycastle-1.84-1.1 on GA media (moderate)

bouncycastle-1.84-1.1 on GA media Announcement ID: openSUSE-SU-2026:10571-1 Rating: moderate Cross-References: CVE-2025-14813 CVE-2026-0636 CVE-2026-3505 CVE-2026-5588 CVE-2026-5598 CVSS scores: CVE-2025-14813 SUSE : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVE-2025-14813 SUSE : 8.3...

CVE-2026-0636 vulnerabilities

Vulnerabilities for packages: pinot-fips, spark, elasticsearch, gradle, nacos-docker, hadoop-fips, druid, apache-pulsar, logstash, ghidra, apache-hop, kayenta-fips, camunda-zeebe, guacamole-client, wildfly, ruby3.3-bouncy-castle-java, zipkin, thingsboard, kserve-modelmesh,...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1245 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk15to18 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.74, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...

org.bouncycastle:bcmail-jdk14 (>=1.74, <=1.83), org.bouncycastle:bcpg-jdk14 (>=1.74, <=1.83) +11 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk14 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.74, =1.74, =1.74, =1.74, =1.74, =1.74, =0.2.5, =1.0.1-rc.1, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.3.2 Source cves: CVE-2026-0636 Source advisory: OSV:GHSA-C3FC-8QFF-9HWX...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1245 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk15to18 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.74, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +17756 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk18on (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.74, =0.2.0, =0.31.0, =0.5.0, =0.6.0, =0.5.0, =0.6.0, =0.5.0, =0.9.1, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.9.0 and more Source cves: CVE-2026-0636 Source advisory: GHSA-C3FC-8QFF-9HWX...

org.bouncycastle:bcmail-jdk14 (>=1.74, <=1.83), org.bouncycastle:bcpg-jdk14 (>=1.74, <=1.83) +11 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk14 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.74, =1.74, =1.74, =1.74, =1.74, =1.74, =0.2.5, =1.0.1-rc.1, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.3.2 Source cves: CVE-2026-0636 Source advisory: GHSA-C3FC-8QFF-9HWX...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1245 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk15to18 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.74, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1245 more potentially affected by CVE-2026-0636 via org.bouncycastle:bcprov-jdk15to18 (>=1.74, <=1.83)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.74, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...