The BC-JAVA cryptographic library contains an LDAP injection vulnerability (CWE-90) in the LDAPStoreHelper component. This occurs due to improper sanitization of special characters in LDAP queries, potentially allowing an attacker to manipulate LDAP operations. The affected versions include 1.74 up to but not including 1.80.2, 1.81 up to but not including 1.81.1, and 1.82 up to but not including 1.84. The vulnerability is publicly known as of April 15, 2026, but no vendor-provided patch or official remediation level has been published.

Successful exploitation could allow an attacker to alter LDAP queries, potentially leading to unauthorized information disclosure or modification within LDAP directories accessed by the vulnerable BC-JAVA library. The CVSS score of 5.5 indicates a medium impact with network attack vector, no privileges required, and no user interaction needed. However, the vulnerability does not affect confidentiality, integrity, or availability directly beyond the LDAP query manipulation scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or implementing additional input validation and sanitization on LDAP queries involving BC-JAVA. Monitor vendor communications for updates on patches or mitigations.