Legion of the Bouncy Castle Inc. BC-FJA
32 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-71888 | 1.0.0 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent | HIGH 8.7 | 0.1 % | ||
| CVE-2026-71889 | 1.0.4 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate | HIGH 8.7 | 0.2 % | ||
| CVE-2026-71892 | 2.0.7 – < 2.0.13 ; 2.1.0 – < 2.1.13 | CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-85515 | 1.0.7 – < 1.0.14 ; 2.0.7 – < 2.0.14.1 ; 2.1.0 – < 2.1.14 | OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check | HIGH 8.2 | 0.2 % | ||
| CVE-2026-17508 | 1.0.0 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-13505 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Zeroisation of sensitive key material on garbage collection relies on finalization | HIGH 8.7 | 0.4 % | ||
| CVE-2026-8798 | 2.1.0 – < 2.1.3 | Native entropy source retries the CPU entropy instructions without limit | HIGH 8.7 | 0.4 % | ||
| CVE-2026-13586 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-13506 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Lazy ASN.1 sequence forcing resets nesting-depth guard | HIGH 8.7 | 0.5 % | ||
| CVE-2026-12817 | 1.0.7 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | OpenPGP AEAD decryption skips final tag on chunk-aligned data | HIGH 8.7 | 0.2 % | ||
| CVE-2026-12802 | 1.0.0 – < 1.0.12 ; 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.12 | CMS AuthEnvelopedData fails to enforce tag-length on decryption | HIGH 8.7 | 0.2 % | ||
| CVE-2026-14682 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Possible OOM from unbounded up-front allocation on a definite-length read | HIGH 8.7 | 0.5 % | ||
| CVE-2026-58059 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Quadratic-time escaping when stringifying X.500 distinguished names | HIGH 8.7 | 0.5 % | ||
| CVE-2026-58060 | 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | HSS public-key level count unbounded, enabling huge allocation on verify | HIGH 8.7 | 0.6 % | ||
| CVE-2026-58061 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | CCM-family modes write plaintext to caller buffer before tag check | HIGH 8.7 | 0.3 % | ||
| CVE-2026-58062 | 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Stapled OCSP response accepted without binding to the checked certificate | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-58063 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | BCFKS keystore load honours unbounded KDF cost from untrusted file | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-59638 | 1.0.7 – < 1.0.24 ; 2.0.0 – < 2.0.24 ; 2.1.0 – < 2.1.24 | JSSE hostname verifier CN-fallback enabled by default despite documented opt-in | CRITICAL 9.3 | 0.3 % | ||
| CVE-2026-59639 | 1.0.0 – < 1.0.12 ; 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.12 | CMS verifySignatures returns true for SignedData with zero signers | HIGH 8.7 | 0.2 % | ||
| CVE-2026-59640 | 1.0.0 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | OpenPGP CFB quick-check oracle active on symmetric/session-key paths | HIGH 8.7 | 0.3 % | ||
| CVE-2026-59641 | 1.0.0 – < 1.0.7 ; 2.0.0 – < 2.0.7 ; 2.1.0 – < 2.1.7 | S/MIME validator trusts signer-asserted signingTime for path validation | HIGH 8.7 | 0.2 % | ||
| CVE-2026-59642 | 1.0.0 – < 1.0.12 ; 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.12 | CMS AuthenticatedData content not bound to MAC when authAttrs present | HIGH 8.7 | 0.3 % | ||
| CVE-2026-59643 | 2.0.12 – < 2.0.13 | OpenPGP inline-signature policy failures silently ignored | HIGH 8.7 | 0.2 % | ||
| CVE-2026-59645 | 2.0.0 – < 2.0.7 ; 2.1.0 – < 2.1.7 | OER parser recurses without depth limit on self-referential IEEE 1609.2 schema | HIGH 8.7 | 0.4 % | ||
| CVE-2026-59646 | 1.0.0 – < 1.0.24 ; 2.0.0 – < 2.0.24 ; 2.1.0 – < 2.1.24 | DTLS handshake reassembler allocates buffer from unchecked 24-bit length | HIGH 8.7 | 0.5 % | ||
| CVE-2026-59647 | 1.0.0 – < 1.0.12 ; 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.12 | CRMF/CMP password-MAC honours unbounded iteration count | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-59648 | 1.0.6 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | OpenPGP Argon2 S2K honours attacker-chosen memory and passes | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-59649 | 1.0.0 – < 1.0.13 ; 2.0.0 – < 2.0.13 ; 2.1.0 – < 2.1.13 | OpenPGP user-attribute subpacket length bounded only by JVM max memory | HIGH 8.7 | 0.5 % | ||
| CVE-2026-8763 | 1.0.0 – < 1.0.2.7 ; 2.0.0 – < 2.0.2 ; 2.1.0 – < 2.1.3 | Name Constraints bypass via trailing dot in rfc822Name and URI | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-15055 | 1.0.0 – < 1.0.12 ; 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.12 | PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-8149 | 2.1.0 – < 2.1.3 | GCM chunking can lead to bad tag exception on decryption | MEDIUM 5.1 | 0.2 % | ||
| CVE-2025-8885 | 1.0.0 – 1.0.2.5 ; 2.0.0 – 2.0.1 | Possible DOS in processing specially formed ASN.1 Object Identifiers | MEDIUM 6.3 | 0.5 % |