CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper

August 3, 2026 (updated September 16, 2026)

Affects Bouncy Castle for Java before 1.85. The escaping added for CVE-2023-33201 and CVE-2026-0636 reached the main Java sources and the jdk1.4 X509LDAPCertStoreSpi but not the jdk1.4 LDAPStoreHelper, whose parseDN() returns an unescaped DN component that callers concatenate into an LDAP filter. Because the jdk1.4 build replaces the patched file with this variant, bcprov-jdk14 never received the fix. A certificate with crafted CN characters can splice extra clauses into the filter passed to the directory search.

References

github.com/bcgit/bc-java/commit/27c468af54ee6c6af87eab5a3a8468dce17e24a0
github.com/bcgit/bc-java/wiki/CVE-2026-59652
nvd.nist.gov/vuln/detail/CVE-2026-59652

Code Behaviors & Features

Detect and mitigate CVE-2026-59652 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →