Skip to content
OpenAdvisories
Medium WID-SEC-2026-3713 22 CVEs

Bouncy Castle: Mehrere Schwachstellen

Published Oct 1, 2026 · Updated Nov 9, 2026 · Revision 6 · de

Vendor: IBM Vendor: SUSE Product: App Connect Enterprise Product: Integration Bus Product: License Metric Tool Product: Linux Product: openSUSE Product: QRadar SIEM Product: SPSS

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bouncy Castle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand auszulösen.

Product

Bouncy Castle ist eine Kryptographie-API für Java.

Vulnerabilities 22

  • High 8.7
    CVE-2026-103603

    Unbounded HSS public key level count allows huge array allocation during signature verification

    Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a si…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-103604

    Quadratic-time escaping when converting X.509 distinguished names to strings

    Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of servi…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-16000

    KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

    Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid a…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-17507

    MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

    In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed inp…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu
  • High 8.7
    CVE-2026-63566

    DTLS handshake reassembler allocates buffer from unchecked 24-bit length

    Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated DTLS peer to cause a denial of service through mem…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-63568

    Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion

    Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaus…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-63571

    Attribute certificate path validation does not verify the attribute certificate's signature

    Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged…

    Legion of the Bouncy Castle bc-csharp
  • High 8.7
    CVE-2026-63574

    Unbounded allocation from OpenPGP signature and user attribute subpacket lengths

    Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remo…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-103601

    CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

    Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged me…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-103602

    Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

    Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-15999

    AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

    Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an Algori…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-16001

    IesEngine stream-mode MAC forgery via length-dependent KDF split

    Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed …

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-18036

    NTRU leaks private key information by reducing secret values with a non-constant-time integer division

    In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret…

    Legion of the Bouncy Castle BC-JAVA bouncycastle bouncycastle Debian Ubuntu Wolfi
  • High 8.2
    CVE-2026-63567

    IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

    Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, t…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-63573

    Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

    Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can sub…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-63576

    URI name constraints checked against a mis-parsed host

    Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from…

    Legion of the Bouncy Castle bc-csharp
  • High 8.2
    CVE-2026-63577

    Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

    Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-con…

    Legion of the Bouncy Castle bc-csharp
  • High 7.1
    CVE-2026-63570

    Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

    Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate …

    Legion of the Bouncy Castle bc-csharp
  • High 7.1
    CVE-2026-63572

    Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files

    Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file to cause a denial of service through CPU exhaustion via an …

    Legion of the Bouncy Castle bc-csharp
  • High 7.1
    CVE-2026-63575

    PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count

    Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKC…

    Legion of the Bouncy Castle bc-csharp
  • High 7.1
    CVE-2026-63578

    Unbounded PBE iteration count when decrypting PKCS#8 private keys

    Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS#8 Enc…

    Legion of the Bouncy Castle bc-csharp
  • Medium 5.3
    CVE-2026-17508

    Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

    In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu

Revision history

  1. #6

    Neue Updates von IBM und IBM-APAR aufgenommen

  2. #5

    Neue Updates von SUSE und IBM aufgenommen

  3. #4

    Neue Updates von openSUSE aufgenommen

  4. #3

    Neue Updates von IBM aufgenommen

  5. #2

    Neue Updates von openSUSE, IBM und SUSE aufgenommen

  6. #1

    Initiale Fassung

References