ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +21490 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcpkix-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcpkix-jdk15on MAVEN version =1.47, =1.0.1, =0.2.3, =4.4.0.0, =0.1.12, =0.1.2, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518995...

br.com.swconsultoria:java-cte (>=3.00.4, <=3.00.8), br.com.swconsultoria:java-mdfe (>=3.00.3, <=3.00.4) +1215 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcprov-jdk16 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk16 MAVEN version =1.38, =3.00.4, =3.00.3, =4.00.10, =1.0, =2.0, =1.2.4, =2.0.0, =2.1-alpha1, =2.1-alpha1, =2.10.0, =2.10.0, =2.11.0 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518982...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

com.amazonaws.s3:jets3t (0.5.0), org.bouncycastle:bcpg-jdk12 (130) +2 more potentially affected by CVE-2026-14682 via org.bouncycastle:bcprov-jdk12 (130)

org.bouncycastle:bcprov-jdk12 MAVEN version 130 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk12 and may be impacted: - com.amazonaws.s3:jets3t 0.5.0 - org.bouncycastle:bcpg-jdk12 130 - org.vafer:jdeb =0.2, =0.2.1, =0.5.0...

br.com.swconsultoria:java-cte (>=3.00.4, <=3.00.8), br.com.swconsultoria:java-mdfe (>=3.00.3, <=3.00.4) +1215 more potentially affected by CVE-2026-14682 via org.bouncycastle:bcprov-jdk16 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk16 MAVEN version =1.38, =3.00.4, =3.00.3, =4.00.10, =1.0, =2.0, =1.2.4, =2.0.0, =2.1-alpha1, =2.1-alpha1, =2.10.0, =2.10.0, =2.11.0 and more Source cves: CVE-2026-14682 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518092...

com.amazonaws.s3:jets3t (0.5.0), org.bouncycastle:bcpg-jdk12 (130) +2 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcprov-jdk12 (130)

org.bouncycastle:bcprov-jdk12 MAVEN version 130 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk12 and may be impacted: - com.amazonaws.s3:jets3t 0.5.0 - org.bouncycastle:bcpg-jdk12 130 - org.vafer:jdeb =0.2, =0.2.1, =0.5.0...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518987...

app.cash.trifle:common (>=0.2.9, <=0.2.10), app.cash.trifle:jvm (>=0.1.0, <=0.2.10) +1030 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcpkix-jdk15to18 (>=1.63, <=1.84)

org.bouncycastle:bcpkix-jdk15to18 MAVEN version =1.63, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =3.5.0.0, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =3.0.8 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518993...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.omnistrate.licensing:omnistrate-licensing-sdk-java (0.1.37) +53 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.11)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =4.12, =4.12, =7.0, =7.0, =7.0, =7.0, =7.0, =7.0, =7.0, =2.73.8, =2.73.8, =2.73.11 - org.brylex:sancus-core 0.2 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518999...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2), ca.denisab85:tn5250j (1.0.0) +127 more potentially affected by CVE-2026-14682 via org.bouncycastle:bcprov-jdk14 (>=1.38, <=1.84)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.p24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.restassuredpdfreport:com.github.lkkushan101.restassuredpdfreport 1.00 and more Source cves: CVE-2026-14682 Source advisory:...

CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...

CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-12817

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

CVE-2026-12803

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12860

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-13506

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-12852

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...