BC
Product
BC-JAVA
54
CVEs
0
On KEV
9.2
Max CVSS
14
New 30D
Severity mix
Critical 4High 34Medium 16Low 0
Watch
Add BC-JAVA to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-71892 | 6.9 | Oct 3 | CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys Affected: 1.78 before 1.86 |
| CVE-2026-59638 | 6.5 | Aug 3 | JSSE hostname verifier CN-fallback enabled by default despite documented opt-in Affected: 1.61 before 1.85 |
| CVE-2026-59652 | 6.5 | Aug 3 | LDAP filter injection in legacy jdk1.4 LDAPStoreHelper Affected: before 1.85 |
| CVE-2026-0636 | 6.5 | Apr 15 | LDAP Injection Vulnerability in LDAPStoreHelper.java Affected: 1.74 before 1.80.2; 1.81 before 1.81.1; 1.82 before 1.84 |
| CVE-2025-8916 | 6.3 | Aug 13 | Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer Affected: 1.44 through 1.78; 1.44 through 1.78 |
| CVE-2025-8885 | 6.3 | Aug 12 | Possible DOS in processing specially formed ASN.1 Object Identifiers Affected: 1.0 through 1.77 |
| CVE-2026-18040 | 5.9 | Oct 3 | HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler Affected: 1.73 before 1.86 |
| CVE-2024-14041 | 5.9 | Jul 28 | ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) Affected: 1.73 before 1.78 |
| CVE-2026-97873 | 5.3 | Oct 3 | Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider Affected: before 1.86 |
| CVE-2026-17508 | 5.3 | Oct 2 | Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points Affected: before 1.86; before 1.86 |
| CVE-2026-12860 | 5.3 | Aug 3 | RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path Affected: before 1.85 |
| CVE-2026-58063 | 5.3 | Aug 3 | BCFKS keystore load honours unbounded KDF cost from untrusted file Affected: before 1.85 |
| CVE-2026-59640 | 5.3 | Aug 3 | OpenPGP CFB quick-check oracle active on symmetric/session-key paths Affected: before 1.85 |
| CVE-2026-59641 | 5.3 | Aug 3 | S/MIME validator trusts signer-asserted signingTime for path validation Affected: before 1.85 |
| CVE-2026-59647 | 5.3 | Aug 3 | CRMF/CMP password-MAC honours unbounded iteration count Affected: before 1.85 |
| CVE-2026-59648 | 5.3 | Aug 3 | OpenPGP Argon2 S2K honours attacker-chosen memory and passes Affected: 1.71 before 1.85 |
Showing 16