JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

LDAP filter injection in legacy jdk1.4 LDAPStoreHelper

ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any…

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat…

RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

BCFKS keystore load honours unbounded KDF cost from untrusted file

OpenPGP CFB quick-check oracle active on symmetric/session-key paths

S/MIME validator trusts signer-asserted signingTime for path validation

CRMF/CMP password-MAC honours unbounded iteration count

OpenPGP Argon2 S2K honours attacker-chosen memory and passes

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore