Quadratic-time escaping when converting X.509 distinguished names to strings

Unbounded HSS public key level count allows huge array allocation during signature verification

CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Unbounded ASN.1 nesting depth causes process-terminating stack overflow

Unbounded PBE iteration count when decrypting PKCS#8 private keys

Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

URI name constraints checked against a mis-parsed host

PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count

Unbounded allocation from OpenPGP signature and user attribute subpacket lengths

Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files

Attribute certificate path validation does not verify the attribute certificate's signature

Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion

IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

DTLS handshake reassembler allocates buffer from unchecked 24-bit length

IesEngine stream-mode MAC forgery via length-dependent KDF split

KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

MTI/A0 DHAgreement does not validate the peer's ephemeral value

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can…

Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts