Advisories for Maven/Org.bouncycastle/Bcprov-Jdk14 package

Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA …

Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the resulting …

Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as …

Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.

Affects Bouncy Castle for Java before 1.85. PKIXNameConstraintValidator strips a trailing dot before comparing dNSName values but not rfc822Name or URI values, which are compared with a plain case-insensitive match. A certificate whose email or URI SAN ends in a dot therefore evades an excludedSubtrees entry for the same host and path validation succeeds. An attacker controlling a name-constrained intermediate CA can issue certificates for names the constraints were meant …

Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is …

Affects Bouncy Castle for Java before 1.85. The escaping added for CVE-2023-33201 and CVE-2026-0636 reached the main Java sources and the jdk1.4 X509LDAPCertStoreSpi but not the jdk1.4 LDAPStoreHelper, whose parseDN() returns an unescaped DN component that callers concatenate into an LDAP filter. Because the jdk1.4 build replaces the patched file with this variant, bcprov-jdk14 never received the fix. A certificate with crafted CN characters can splice extra clauses into the …

Affects Bouncy Castle for Java before 1.85. LazyEncodedSequence.force() parses the deferred SEQUENCE with a fresh nesting-depth counter instead of inheriting the parent's remaining budget, and never decrements it. CRLs loaded through X509CRLHolder or the BC CertificateFactory hold revokedCertificates as an unforced lazy sequence, so a 40-50 KB DER CRL nesting around 10,000 SEQUENCEs recurses one frame per level on hashing, comparison or encoding. The resulting StackOverflowError is usually uncaught and …

Affects Bouncy Castle for Java before 1.85. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext and …

Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without …

Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing …

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select …

Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.84.

The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Legion of the Bouncy Castle BC-JAVA bcprov core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with …

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module. This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up …

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.2.1, BC before 1.66, BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key …

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include …

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output …

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially …

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.