An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4.
Priority LOW 25CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
Why it matters now
EPSS 0.00447 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.bouncycastle:bc-fips (Maven): 1.0.2.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.bouncycastle:bc-fips (Maven) | before 1.0.2.4 | 1.0.2.4 | Patch available | GHSA-68m8-v89j-7j2p |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.bouncycastle:bc-fips (Maven) Vendor— Affected before 1.0.2.4 Fixed in 1.0.2.4 Patch available GHSA-68m8-v89j-7j2p
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:* | before 1.0.2.4 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:* | 13.0.0 | Running on | Oracle |
- cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:* Versions before 1.0.2.4 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:* Versions 13.0.0 Running on ·Oracle
Remediation
- Fix · GHSA-68m8-v89j-7j2p org.bouncycastle:bc-fips (Maven) Fixed in 1.0.2.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Quarkus
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-45146
- 2026-10-03 Alias added: GHSA-68m8-v89j-7j2p
References
More Legion of the Bouncy Castle Inc. Fips Java Api vulnerabilities
- TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
- TI-2026-41814 HSS public-key level count unbounded, enabling huge allocation on verify CVSS 4.0HIGH 8.7
- TI-2026-41813 Quadratic-time escaping when stringifying X.500 distinguished names CVSS 4.0HIGH 8.7
- TI-2026-12374 Possible OOM from unbounded up-front allocation on a definite-length read CVSS 4.0HIGH 8.7
- TI-2026-11431 Lazy ASN.1 sequence forcing resets nesting-depth guard CVSS 4.0HIGH 8.7
Sources
- CVE-2022-45146 · CVE Program
- CVE-2022-45146 · NVD
- FIRST EPSS
- GHSA-68m8-v89j-7j2p · GitHub Advisory Database · CC BY 4.0
- CVE-2022-45146 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences