Legion of the Bouncy Castle Inc.
Records110All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high68CVSS 7.0–8.9
Exploited now
Legion of the Bouncy Castle Inc. records in CISA KEVNo Legion of the Bouncy Castle Inc. vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 48
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00345 · Published 2026-08-03 · Fixed in 1.85, 2.73.12 +3 CWE-297
Priority MEDIUM 44
In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00465 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 +3 CWE-789
Priority MEDIUM 44
In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 +4 CWE-789
