Legion of the Bouncy Castle Inc.

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate.

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI.

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify.

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names.

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read.

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check.

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have l…

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when…

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class.

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs.

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS).

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4.

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file.