How many bouncycastle fips java api CVEs are in CISA KEV?

None of bouncycastle fips java api's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of bouncycastle fips java api are affected?

14 distinct bouncycastle fips java api versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in bouncycastle fips java api CVEs?

bouncycastle fips java api's CVEs most often map to these CWE weakness types: CWE-295 (Improper Certificate Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-789 (Memory Allocation with Excessive Size Value), CWE-354 (Improper Validation of Integrity Check Value).

How many critical bouncycastle fips java api vulnerabilities are there?

bouncycastle fips java api has 2 critical and 6 high-severity CVEs.

What is the average severity of bouncycastle fips java api CVEs?

The average CVSS base score across bouncycastle fips java api's scored CVEs is 7.3.

RadicalNotion.AI

Log in Start free

bouncycastle

14 CVEs

bouncycastle fips java api Vulnerabilities

Name: bouncycastle fips java api vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for fips java api by bouncycastle.

14

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.3

Avg CVSS

2018–2026

Last updated August 3, 2026

Overview

bouncycastle fips java api has 14 published CVE records since 2018, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting bouncycastle fips java api, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include jdk.

Severity and exploitation

How the CVSS severity of bouncycastle fips java api's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High6

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of bouncycastle fips java api's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No bouncycastle fips java api CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every bouncycastle fips java api version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

2.1.0 <= v < 2.1.39 CVEs
1.0.0 <= v < 1.0.2.77 CVEs
2.0.0 <= v < 2.0.27 CVEs
< 1.0.1.22 CVEs
< 1.0.2.42 CVEs
< 2.0.22 CVEs
<= 1.0.11 CVE
1.0.2 <= v < 1.0.2.11 CVE

Fixed in

2.0.29 CVEs
2.1.39 CVEs
1.0.2.77 CVEs
1.0.1.22 CVEs
1.0.2.42 CVEs
1.0.2.11 CVE

Find a version

14 CVEs

Sort

PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
CVE-2026-13586
Patch
CWE-770
Medium · CVSS 5.3
EPSS 0.4% (28th pct)2026-08-03
Lazy ASN.1 sequence forcing resets nesting-depth guard
CVE-2026-13506
Patch
CWE-674
High · CVSS 8.7
EPSS 0.3% (23th pct)2026-08-03
Possible OOM from unbounded up-front allocation on a definite-length read
CVE-2026-14682
Patch
CWE-789
High · CVSS 8.7
EPSS 0.3% (23th pct)2026-08-03
Quadratic-time escaping when stringifying X.500 distinguished names
CVE-2026-58059
Patch
CWE-407
High · CVSS 8.7
EPSS 0.3% (28th pct)2026-08-03
HSS public-key level count unbounded, enabling huge allocation on verify
CVE-2026-58060
Patch
CWE-789
High · CVSS 8.7
EPSS 0.4% (32th pct)2026-08-03
CCM-family modes write plaintext to caller buffer before tag check
CVE-2026-58061
Patch
CWE-354
High · CVSS 8.7
EPSS 0.2% (13th pct)2026-08-03
Stapled OCSP response accepted without binding to the checked certificate
CVE-2026-58062
Patch
CWE-295
Critical · CVSS 9.3
EPSS 0.2% (12th pct)2026-08-03
BCFKS keystore load honours unbounded KDF cost from untrusted file
CVE-2026-58063
Patch
CWE-770
Medium · CVSS 5.3
EPSS 0.3% (28th pct)2026-08-03
Name Constraints bypass via trailing dot in rfc822Name and URI
CVE-2026-8763
Patch
CWE-295
Critical · CVSS 9.3
EPSS 0.4% (28th pct)2026-08-03
Medium vulnerability · 2023-11-23
CVE-2023-33202
Patch
Medium · CVSS 5.5
EPSS 0.9% (58th pct)2023-11-23
Medium vulnerability · 2022-11-21
CVE-2022-45146
Patch
Medium · CVSS 5.5
EPSS 0.4% (36th pct)2022-11-21
Medium vulnerability · 2021-05-20
CVE-2020-15522
Patch
Medium · CVSS 5.9
EPSS 1.5% (73th pct)2021-05-20
Medium vulnerability · 2020-11-02
CVE-2020-26939
Patch
Medium · CVSS 5.3
EPSS 0.9% (58th pct)2020-11-02
High vulnerability · 2018-06-05
CVE-2018-1000180
Patch
High · CVSS 7.5
EPSS 3.6% (89th pct)2018-06-05

Common weakness types

The CWE weakness categories most often found in bouncycastle fips java api CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many bouncycastle fips java api CVEs were published each year.

2018

1

2020

1

2021

1

2022

1

2023

1

2026

9

Other bouncycastle products

Browse vulnerabilities for other products by bouncycastle.

bc-java52 CVEs bouncy castle for java lts28 CVEs bcpkix-fips5 CVEs bcpg-fips4 CVEs bctls-fips3 CVEs bc-fja2 CVEs bouncy castle for java2 CVEs legion-of-the-bouncy-castle-java-crytography-api2 CVEs

All bouncycastle vulnerabilities

Frequently asked questions

Common questions about bouncycastle fips java api vulnerabilities.

How many CVEs does bouncycastle fips java api have?: bouncycastle fips java api has 14 published CVE records since 2018.
How many bouncycastle fips java api CVEs are in CISA KEV?: None of bouncycastle fips java api's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for bouncycastle fips java api vulnerabilities?: No bouncycastle fips java api CVEs currently have a tracked public exploit in this dataset.
Which versions of bouncycastle fips java api are affected?: 14 distinct bouncycastle fips java api versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in bouncycastle fips java api CVEs?: bouncycastle fips java api's CVEs most often map to these CWE weakness types: CWE-295 (Improper Certificate Validation), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-789 (Memory Allocation with Excessive Size Value), CWE-354 (Improper Validation of Integrity Check Value).
How many critical bouncycastle fips java api vulnerabilities are there?: bouncycastle fips java api has 2 critical and 6 high-severity CVEs.
What is the average severity of bouncycastle fips java api CVEs?: The average CVSS base score across bouncycastle fips java api's scored CVEs is 7.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track bouncycastle fips java api vulnerabilities

Monitor new bouncycastle fips java api vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing