CVE-2026-0636 LDAP Injection Vulnerability in LDAPStoreHelper.java
An LDAP injection vulnerability in the Bouncy Castle Java library allows attackers to manipulate LDAP queries, potentially leading to unauthorized data access or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0636?
CVE-2026-0636 is a medium-severity vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Weakness: CWE-90
Which versions are affected by CVE-2026-0636?
6 open source packages ship an affected version, including org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 and org.bouncycastle:bcprov-jdk18on.
| Package | Affected | Fixed in |
|---|---|---|
org.bouncycastle:bcprov-jdk14 Maven | From 1.74 | 1.84 |
org.bouncycastle:bcprov-jdk14 Maven | From 1.74 | 1.84 |
org.bouncycastle:bcprov-jdk15to18 Maven | From 1.74 | 1.84 |
org.bouncycastle:bcprov-jdk15to18 Maven | From 1.74 | 1.84 |
org.bouncycastle:bcprov-jdk18on Maven | From 1.74 | 1.84 |
org.bouncycastle:bcprov-jdk18on Maven | From 1.74 | 1.84 |
How do I fix CVE-2026-0636?
Upgrade org.bouncycastle:bcprov-jdk14 to 1.84 or later.
Is CVE-2026-0636 being exploited?
There is no known exploitation of CVE-2026-0636 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FV35085, CLEANSTART-2026-GK94904, CLSA-2026-1787930356, DEBIAN-CVE-2026-0636, ECHO-4873-562c-433e, GHSA-c3fc-8qff-9hwx and 52 more.