Bouncycastle Bc-Java vulnerabilities
53 published vulnerabilities in Bouncycastle Bc-Java. The most were published in 2026 (33), and 33 so far in 2026.
Bouncycastle Bc-Java vulnerabilities by year
2007
2013
2016
2017
2018
2019
2020
2023
2024
2026
Most exploited Bouncycastle Bc-Java vulnerabilities
- CVE-2007-6721 Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
- CVE-2018-1000613 Deserialization of Untrusted Data in Bouncy castle
- CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate
- CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
- CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value
- CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI
- CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender
- CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption
- CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
- CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split
- CVE-2026-12817 OpenPGP AEAD decryption skips final tag on chunk-aligned data
- CVE-2026-12852 MLS wire decoder allocates attacker-declared opaque length before bounds check
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.