The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in…
Priority MEDIUM 47CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-203.
Summary
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
Why it matters now
EPSS 0.02413 84th percentileScored 2026-11-07
Fix Fixed bouncycastle:bcprov-jdk14 (Maven): 1.38bouncycastle:bcprov-jdk15 (Maven): 1.38+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | bouncycastle:bcprov-jdk14 (Maven) | before 1.38 | 1.38 | Patch available | GHSA-m26p-m559-g5j5 |
| — | bouncycastle:bcprov-jdk15 (Maven) | before 1.38 | 1.38 | Patch available | GHSA-m26p-m559-g5j5 |
| — | bouncycastle:bcprov-jdk16 (Maven) | before 1.38 | 1.38 | Patch available | GHSA-m26p-m559-g5j5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected before 1.38 Fixed in 1.38 Patch available GHSA-m26p-m559-g5j5
- bouncycastle:bcprov-jdk15 (Maven) Vendor— Affected before 1.38 Fixed in 1.38 Patch available GHSA-m26p-m559-g5j5
- bouncycastle:bcprov-jdk16 (Maven) Vendor— Affected before 1.38 Fixed in 1.38 Patch available GHSA-m26p-m559-g5j5
CPE configurations NVD · 72
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* | up to 1.37 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:* | 1.02 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:* | 1.03 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:* | 1.04 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:* | 1.05 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.06:*:*:*:*:*:*:* | 1.06 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.07:*:*:*:*:*:*:* | 1.07 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.08:*:*:*:*:*:*:* | 1.08 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.09:*:*:*:*:*:*:* | 1.09 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions up to 1.37 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:* Versions 1.05 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.06:*:*:*:*:*:*:* Versions 1.06 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.08:*:*:*:*:*:*:* Versions 1.08 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.09:*:*:*:*:*:*:* Versions 1.09 Vulnerable ·Legion of the Bouncy Castle Inc.
Show 62 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:1.10:*:*:*:*:*:*:* | 1.10 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.11:*:*:*:*:*:*:* | 1.11 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.12:*:*:*:*:*:*:* | 1.12 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.13:*:*:*:*:*:*:* | 1.13 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.14:*:*:*:*:*:*:* | 1.14 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.15:*:*:*:*:*:*:* | 1.15 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.16:*:*:*:*:*:*:* | 1.16 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.17:*:*:*:*:*:*:* | 1.17 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.18:*:*:*:*:*:*:* | 1.18 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.19:*:*:*:*:*:*:* | 1.19 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.20:*:*:*:*:*:*:* | 1.20 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.21:*:*:*:*:*:*:* | 1.21 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.22:*:*:*:*:*:*:* | 1.22 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.23:*:*:*:*:*:*:* | 1.23 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.24:*:*:*:*:*:*:* | 1.24 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.25:*:*:*:*:*:*:* | 1.25 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.26:*:*:*:*:*:*:* | 1.26 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.27:*:*:*:*:*:*:* | 1.27 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.28:*:*:*:*:*:*:* | 1.28 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.29:*:*:*:*:*:*:* | 1.29 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.30:*:*:*:*:*:*:* | 1.30 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.31:*:*:*:*:*:*:* | 1.31 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.32:*:*:*:*:*:*:* | 1.32 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.33:*:*:*:*:*:*:* | 1.33 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.34:*:*:*:*:*:*:* | 1.34 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.35:*:*:*:*:*:*:* | 1.35 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.36:*:*:*:*:*:*:* | 1.36 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:*:*:*:*:*:*:*:* | up to 1.35 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.02:*:*:*:*:*:*:* | 1.02 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.03:*:*:*:*:*:*:* | 1.03 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.3.1:*:*:*:*:*:*:* | 1.3.1 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.04:*:*:*:*:*:*:* | 1.04 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.05:*:*:*:*:*:*:* | 1.05 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.06:*:*:*:*:*:*:* | 1.06 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.07:*:*:*:*:*:*:* | 1.07 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.08:*:*:*:*:*:*:* | 1.08 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.09:*:*:*:*:*:*:* | 1.09 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.11:*:*:*:*:*:*:* | 1.11 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.12:*:*:*:*:*:*:* | 1.12 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.13:*:*:*:*:*:*:* | 1.13 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.14:*:*:*:*:*:*:* | 1.14 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.15:*:*:*:*:*:*:* | 1.15 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.16:*:*:*:*:*:*:* | 1.16 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.17:*:*:*:*:*:*:* | 1.17 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.18:*:*:*:*:*:*:* | 1.18 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.19:*:*:*:*:*:*:* | 1.19 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.20:*:*:*:*:*:*:* | 1.20 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.21:*:*:*:*:*:*:* | 1.21 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.22:*:*:*:*:*:*:* | 1.22 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.23:*:*:*:*:*:*:* | 1.23 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.24:*:*:*:*:*:*:* | 1.24 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.25:*:*:*:*:*:*:* | 1.25 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.26:*:*:*:*:*:*:* | 1.26 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.27:*:*:*:*:*:*:* | 1.27 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.28:*:*:*:*:*:*:* | 1.28 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.29:*:*:*:*:*:*:* | 1.29 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.30:*:*:*:*:*:*:* | 1.30 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.32:*:*:*:*:*:*:* | 1.32 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.33:*:*:*:*:*:*:* | 1.33 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.34:*:*:*:*:*:*:* | 1.34 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-java:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.26:*:*:*:*:*:*:* Versions 1.26 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.27:*:*:*:*:*:*:* Versions 1.27 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.28:*:*:*:*:*:*:* Versions 1.28 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.29:*:*:*:*:*:*:* Versions 1.29 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.30:*:*:*:*:*:*:* Versions 1.30 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.32:*:*:*:*:*:*:* Versions 1.32 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.33:*:*:*:*:*:*:* Versions 1.33 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.34:*:*:*:*:*:*:* Versions 1.34 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.35:*:*:*:*:*:*:* Versions 1.35 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.36:*:*:*:*:*:*:* Versions 1.36 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:*:*:*:*:*:*:*:* Versions up to 1.35 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.05:*:*:*:*:*:*:* Versions 1.05 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.06:*:*:*:*:*:*:* Versions 1.06 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.08:*:*:*:*:*:*:* Versions 1.08 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.09:*:*:*:*:*:*:* Versions 1.09 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.26:*:*:*:*:*:*:* Versions 1.26 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.27:*:*:*:*:*:*:* Versions 1.27 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.28:*:*:*:*:*:*:* Versions 1.28 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.29:*:*:*:*:*:*:* Versions 1.29 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.30:*:*:*:*:*:*:* Versions 1.30 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.32:*:*:*:*:*:*:* Versions 1.32 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.33:*:*:*:*:*:*:* Versions 1.33 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.34:*:*:*:*:*:*:* Versions 1.34 Vulnerable ·Legion of the Bouncy Castle Inc.
Remediation
- Fix · GHSA-m26p-m559-g5j5 bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.38 Advisory →
- Fix · GHSA-m26p-m559-g5j5 bouncycastle:bcprov-jdk15 (Maven) Fixed in 1.38 Advisory →
- Fix · GHSA-m26p-m559-g5j5 bouncycastle:bcprov-jdk16 (Maven) Fixed in 1.38 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2007-6721
- 2026-10-03 Alias added: GHSA-m26p-m559-g5j5
References
Patch 2
Other 8
- http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580
- 50358
- 50360
- http://www.bouncycastle.org/releasenotes.html
- 50359
- https://github.com/bcgit/bc-java
- https://web.archive.org/web/20071022023551/http://www.bouncycastle.org/csharp
- https://web.archive.org/web/20080316202318/http://www.bouncycastle.org:80/releasenotes.html
More Legion of the Bouncy Castle Inc. Bc-java vulnerabilities
- TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
- TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
- TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
- TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
- TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
Sources
- CVE-2007-6721 · CVE Program
- CVE-2007-6721 · NVD
- FIRST EPSS
- GHSA-m26p-m559-g5j5 · GitHub Advisory Database · CC BY 4.0
- CVE-2007-6721 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences