Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in Start free

Home
Vendors
Bouncycastle
Bouncy Castle For Java Lts

bouncycastle bouncy castle for java lts Vulnerabilities: CVEs, CISA KEV & Security Advisories

17 CVEs

BC

bouncycastle bouncy castle for java lts Vulnerabilities

CVE security advisories and vulnerability history for bouncy castle for java lts by bouncycastle.

17

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

8.1

Avg CVSS

2026–2026

Last updated August 3, 2026

Overview

bouncycastle bouncy castle for java lts has 17 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 8.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting bouncycastle bouncy castle for java lts, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of bouncycastle bouncy castle for java lts's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High11

Medium4

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of bouncycastle bouncy castle for java lts's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No bouncycastle bouncy castle for java lts CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every bouncycastle bouncy castle for java lts version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= 2.73.1117 CVEs

Find a version

17 CVEs

Sort

PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
CVE-2026-13586
Patch
CWE-770
Medium · CVSS 5.3
EPSS 0.4% (28th pct)2026-08-03
Lazy ASN.1 sequence forcing resets nesting-depth guard
CVE-2026-13506
Patch
CWE-674
High · CVSS 8.7
EPSS 0.3% (23th pct)2026-08-03
RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
CVE-2026-12860
Patch
CWE-347
High · CVSS 8.7
EPSS 0.1% (4th pct)2026-08-03
OpenPGP AEAD decryption skips final tag on chunk-aligned data
CVE-2026-12817
Patch
CWE-354
High · CVSS 8.7
EPSS 0.1% (4th pct)2026-08-03
Possible OOM from unbounded up-front allocation on a definite-length read
CVE-2026-14682
Patch
CWE-789
High · CVSS 8.7
EPSS 0.3% (23th pct)2026-08-03
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
CVE-2026-59638
Patch
CWE-297
Critical · CVSS 9.3
EPSS 0.2% (11th pct)2026-08-03
CMS verifySignatures returns true for SignedData with zero signers
CVE-2026-59639
Patch
CWE-347
High · CVSS 8.7
EPSS 0.2% (6th pct)2026-08-03
OpenPGP CFB quick-check oracle active on symmetric/session-key paths
CVE-2026-59640
Patch
CWE-203
High · CVSS 8.7
EPSS 0.2% (12th pct)2026-08-03
S/MIME validator trusts signer-asserted signingTime for path validation
CVE-2026-59641
Patch
CWE-345
High · CVSS 8.7
EPSS 0.1% (4th pct)2026-08-03
CMS AuthenticatedData content not bound to MAC when authAttrs present
CVE-2026-59642
Patch
CWE-354
High · CVSS 8.7
EPSS 0.1% (4th pct)2026-08-03
OER parser recurses without depth limit on self-referential IEEE 1609.2 schema
CVE-2026-59645
Patch
CWE-674
High · CVSS 8.7
EPSS 0.3% (23th pct)2026-08-03
DTLS handshake reassembler allocates buffer from unchecked 24-bit length
CVE-2026-59646
Patch
CWE-789
High · CVSS 8.7
EPSS 0.4% (28th pct)2026-08-03
CRMF/CMP password-MAC honours unbounded iteration count
CVE-2026-59647
Patch
CWE-770
Medium · CVSS 6.9
EPSS 0.3% (19th pct)2026-08-03
OpenPGP Argon2 S2K honours attacker-chosen memory and passes
CVE-2026-59648
Patch
CWE-770
Medium · CVSS 6.9
EPSS 0.3% (19th pct)2026-08-03
MTI/A0 DH agreement exponentiates unvalidated peer value
CVE-2026-59650
Patch
CWE-20
Critical · CVSS 9.3
EPSS 0.3% (19th pct)2026-08-03
BKS/UBER keystore allocates from untrusted lengths before integrity check
CVE-2026-12185
Patch
CWE-789
High · CVSS 7.1
EPSS 0.2% (14th pct)2026-08-03
PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input
CVE-2026-15055
Patch
CWE-770
Medium · CVSS 5.3
EPSS 0.3% (19th pct)2026-08-03

Common weakness types

The CWE weakness categories most often found in bouncycastle bouncy castle for java lts CVEs. Follow any weakness for its full explanation.

CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-789Memory Allocation with Excessive Size Value3 CVEs
CWE-347Improper Verification of Cryptographic Signature2 CVEs
CWE-354Improper Validation of Integrity Check Value2 CVEs
CWE-674Uncontrolled Recursion2 CVEs
CWE-297Improper Validation of Certificate with Host Mismatch1 CVE
CWE-203Observable Discrepancy1 CVE
CWE-345Insufficient Verification of Data Authenticity1 CVE

Other bouncycastle products

Browse vulnerabilities for other products by bouncycastle.

bc-java40 CVEs fips java api8 CVEs bcpkix-fips4 CVEs bcpg-fips3 CVEs bctls-fips3 CVEs bc-fja2 CVEs bouncy castle for java2 CVEs legion-of-the-bouncy-castle-java-crytography-api2 CVEs

All bouncycastle vulnerabilities

Frequently asked questions

Common questions about bouncycastle bouncy castle for java lts vulnerabilities.

How many CVEs does bouncycastle bouncy castle for java lts have?: bouncycastle bouncy castle for java lts has 17 published CVE records since 2026.
How many bouncycastle bouncy castle for java lts CVEs are in CISA KEV?: None of bouncycastle bouncy castle for java lts's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for bouncycastle bouncy castle for java lts vulnerabilities?: No bouncycastle bouncy castle for java lts CVEs currently have a tracked public exploit in this dataset.
Which versions of bouncycastle bouncy castle for java lts are affected?: 1 distinct bouncycastle bouncy castle for java lts version is named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in bouncycastle bouncy castle for java lts CVEs?: bouncycastle bouncy castle for java lts's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-789 (Memory Allocation with Excessive Size Value), CWE-347 (Improper Verification of Cryptographic Signature), CWE-354 (Improper Validation of Integrity Check Value).
How many critical bouncycastle bouncy castle for java lts vulnerabilities are there?: bouncycastle bouncy castle for java lts has 2 critical and 11 high-severity CVEs.
What is the average severity of bouncycastle bouncy castle for java lts CVEs?: The average CVSS base score across bouncycastle bouncy castle for java lts's scored CVEs is 8.1.

References

All bouncycastle vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track bouncycastle bouncy castle for java lts vulnerabilities

Monitor new bouncycastle bouncy castle for java lts vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Other products
FAQ
References