Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

CVE-2026-15997

BC-LTS bcprov-lts8on (ARM) contains a native C vulnerability in SHA3/SHAKE handling: restoreFullState may underflow size_t in crafted encoded state, enabling an out-of-bounds write. Affects BC-LTS 2.73.0–before 2.73.12.1; control flows that accept memoable SHA3/SHAKE states from untrusted sources...

CVE-2026-15997 Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in DisposalDaemon.java. In high-core environments under heavy load, the disposal thread can fall behind and allow excessive memory use. Note This issue was reported for environments...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the AESNativeCBC class due to the use of a private instance class, rather than a private static class. An attacker can cause heap exhaustion by triggering excessive memory allocati...