JLSEC-2026-1118

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikonloadpaddedpackedraw of the file src/decoders/decoderslibraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument loadflags/rawwidth can lead to out-of-bounds read. It is possible to launch the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Allocation of Resources Without...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the BcKeyStoreSpi.engineLoad method, which sizes buffers for the certificate chain array, encoded certificates, encoded key material, entry data, and PBE salts directly from readInt length...

Inadequate Encryption Strength

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20...

CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

PT-2026-76156

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon load padded packed raw of the file src/decoders/decoders libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load flags/raw width can lead to out-of-bounds read. It is possible to laun...

PT-2026-76154

An integer overflow vulnerability exists in the uncompressed fp dng load raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76148

In LibRaw before 0.21.4, phase one correct in decoders/load mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations...

PT-2026-76151

An integer overflow vulnerability exists in the deflate dng load raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76149

In LibRaw before 0.21.4, phase one correct in decoders/load mfbacks.cpp allows out-of-buffer access because split col and split row values are not checked in 0x041f tag processing...

PT-2026-76153

A heap-based buffer overflow vulnerability exists in the lossless jpeg load raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76150

In LibRaw before 0.21.4, tag 0x412 processing in phase one correct in decoders/load mfbacks.cpp does not enforce minimum w0 and w1 values...

CVE-2026-58063: Allocation of Resources Without Limits or Throttling

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...