How many CVEs does bouncycastle have?

bouncycastle has 48 published CVE records since 2009, including 20 in the last two years.

How many bouncycastle CVEs are in CISA KEV?

None of bouncycastle's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which bouncycastle products have the most CVEs?

The bouncycastle products with the most published CVEs are bc-java, bouncy castle for java lts, fips java api, bcpkix-fips, bcpg-fips.

What are the most common weakness types in bouncycastle CVEs?

bouncycastle's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-789 (Memory Allocation with Excessive Size Value), CWE-203 (Observable Discrepancy), CWE-347 (Improper Verification of Cryptographic Signature).

How many critical bouncycastle vulnerabilities are there?

bouncycastle has 4 critical and 25 high-severity CVEs.

What is the average severity of bouncycastle CVEs?

The average CVSS base score across bouncycastle's scored CVEs is 7.2.

RadicalNotion.AI

Log in Start free

48 CVEs

bouncycastle Vulnerabilities

Name: bouncycastle vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for bouncycastle.

48

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.2

Avg CVSS

2009–2026

Overview

bouncycastle has 48 published CVE records since 2009, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting bouncycastle products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on bouncycastle's vulnerability posture, as a share of its 48 published CVEs.

Average CVSS: 7.2
Critical / high: 60%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 98%

Severity and exploitation

How the CVSS severity of bouncycastle's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High25

Medium18

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of bouncycastle's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No bouncycastle CVEs currently have a tracked public exploit.

Most affected products

The bouncycastle products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in bouncycastle CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish bouncycastle CVE records.

Disclosure activity by year

How many bouncycastle CVEs were published each year.

2018

13

2019

1

2020

2

2021

1

2022

1

2023

2

2024

3

2026

20

Latest bouncycastle CVEs

The most recently disclosed vulnerabilities affecting bouncycastle.

PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
CWE-770
Medium · CVSS 5.3
EPSS 0.4%2026-08-03
Lazy ASN.1 sequence forcing resets nesting-depth guard
CWE-674
High · CVSS 8.7
EPSS 0.3%2026-08-03
RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
CWE-347
High · CVSS 8.7
EPSS 0.1%2026-08-03
MLS wire decoder allocates attacker-declared opaque length before bounds check
CWE-789
High · CVSS 8.7
EPSS 0.3%2026-08-03
OpenPGP AEAD decryption skips final tag on chunk-aligned data
CWE-354
High · CVSS 8.7
EPSS 0.1%2026-08-03
Possible OOM from unbounded up-front allocation on a definite-length read
CWE-789
High · CVSS 8.7
EPSS 0.3%2026-08-03
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
CWE-297
Critical · CVSS 9.3
EPSS 0.2%2026-08-03
CMS verifySignatures returns true for SignedData with zero signers
CWE-347
High · CVSS 8.7
EPSS 0.2%2026-08-03
OpenPGP CFB quick-check oracle active on symmetric/session-key paths
CWE-203
High · CVSS 8.7
EPSS 0.2%2026-08-03
S/MIME validator trusts signer-asserted signingTime for path validation
CWE-345
High · CVSS 8.7
EPSS 0.1%2026-08-03
CMS AuthenticatedData content not bound to MAC when authAttrs present
CWE-354
High · CVSS 8.7
EPSS 0.1%2026-08-03
MLS hash-ratchet honours arbitrary 32-bit generation counter from sender
CWE-834
High · CVSS 8.7
EPSS 0.3%2026-08-03

Track new bouncycastle CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor bouncycastle CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about bouncycastle vulnerabilities.

How many CVEs does bouncycastle have?: bouncycastle has 48 published CVE records since 2009, including 20 in the last two years.
How many bouncycastle CVEs are in CISA KEV?: None of bouncycastle's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which bouncycastle products have the most CVEs?: The bouncycastle products with the most published CVEs are bc-java, bouncy castle for java lts, fips java api, bcpkix-fips, bcpg-fips.
What are the most common weakness types in bouncycastle CVEs?: bouncycastle's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-789 (Memory Allocation with Excessive Size Value), CWE-203 (Observable Discrepancy), CWE-347 (Improper Verification of Cryptographic Signature).
Are there public exploits for bouncycastle vulnerabilities?: No bouncycastle CVEs currently have a tracked public exploit in this dataset.
How many critical bouncycastle vulnerabilities are there?: bouncycastle has 4 critical and 25 high-severity CVEs.
What is the average severity of bouncycastle CVEs?: The average CVSS base score across bouncycastle's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track bouncycastle vulnerabilities

Monitor new bouncycastle vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing