Security Bulletin: IBM BigMemory Max is affected by bcprov-jdk18on that could allow attackers to execute a denial of service by exhausting system resources

Summary IBM BigMemory Max utilizes bcprov-jdk18on for TLS/SSL connections, digital signature generation/verification, file/data encryption, secure key storage PKCS12, PKCS8, and supporting modern cryptographic standards. Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for...

Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Crowd Data Center

This Critical severity Cryptographic Failure vulnerability was introduced in version 7.2.0 of Crowd Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 9.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber allows an unauthenticate...

Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Cryptographic Failure vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2,...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Jira Service Management Data Center

This Medium severity Cryptographic Failure vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, and 11.1.0 of Jira Service Management Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Jira Software Data Center

This High severity Cryptographic Failure vulnerability was introduced in version 10.3.0 of Jira Software Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber allows an...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Crucible Server

This High severity Cryptographic Failure vulnerability was introduced in version 4.9.14 of Crucible Server. This Cryptographic Failure vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber allows an unauthenticated...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

This High severity Cryptographic Failure vulnerability was introduced in versions 10.2.22 and 12.1.10 of Bamboo Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber allows an...

ROOT-APP-MAVEN-CVE-2018-1000180 CVE-2018-1000180 in org.bouncycastle:bcprov-jdk15on - Patched by Root

Root has patched CVE-2018-1000180 in the org.bouncycastle:bcprov-jdk15on package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-33202 CVE-2023-33202 in org.bouncycastle:bcprov-jdk15on - Patched by Root

Root has patched CVE-2023-33202 in the org.bouncycastle:bcprov-jdk15on package for Root:Maven. Multiple fixed versions available...

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the process handling AES packet cipher operations when the same Java array is used as both input and output. An attacker can obtain the raw AES key instead of the expected ciphertext by exploiting the way JNI's...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +19485 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-jdk18on (>=1.73, <=1.85.2)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.73, =0.2.0, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.9.8 and more Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536929...

org.bouncycastle:bcmail-jdk14 (>=1.73, <=1.85), org.bouncycastle:bcpg-jdk14 (>=1.73, <=1.85) +11 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-jdk14 (>=1.73, <=1.85.1)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.73, =1.73, =1.73, =1.73, =1.73, =1.73, =0.2.5, =1.0.1-rc.1, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.3.2 Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536927...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-debug-jdk18on (>=1.74, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.74, =4.7.0, =4.7.0, =3.0.0-rc1, =3.0.0-rc1, =3.2.0, =3.20.7, =3.20.7, =3.20.7, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536926...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) +4 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536925...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-core (>=0.7.0, <=0.9.8) +3955 more potentially affected by CVE-2026-71891 via org.bouncycastle:bcprov-jdk18on (>=1.85, <=1.85.2)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.85, =0.9.3, =0.7.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.7.0, =0.9.3, =0.7.0, =0.7.0, =2.6.0-rc-1, =2.6.0-rc-1, =2.6.0-rc-1, =2.6.0-rc-1, =2.7.1 and more Source cves: CVE-2026-71891 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20419452...

org.bouncycastle:bcjmail-debug-jdk15to18 (1.85), org.bouncycastle:bcmail-debug-jdk15to18 (1.85) +4 more potentially affected by CVE-2026-71891 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.85, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.85, =1.85, =1.85.1 Source cves: CVE-2026-71891 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20419449...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...