CLSA-2026-1781571259 TuxCare security update for org.bouncycastle (3 CVEs)

TuxCare rebuilt 12 org.bouncycastle packages to address 3 CVEs. Fixed in 1.64-tuxcare.5...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...

Covert timing channel at org.bouncycastle:bcprov-jdk18on dependency in Bamboo Data Center

This High severity Information Disclosure vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.9 and a CVSS Vector of code...

Denial Of Service (DoS)

org.bouncycastle, bc-fips is vulnerable to Denial Of Service DoS. The vulnerability is due to excessive allocation in the org.Bouncycastle.Crypto.Fips.NativeLoader module, which allows an attacker to exhaust system resources and cause a denial of service...

CVE-2025-9340

Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All API modules. This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0...