CVE-2026-0636 is a medium severity LDAP injection vulnerability (CWE-90) in the BC-JAVA bcprov library by Legion of the Bouncy Castle Inc., specifically in the LDAPStoreHelper.java implementation. The vulnerability occurs because the LDAPStoreHelper fails to properly neutralize special LDAP characters in user-supplied input before incorporating it into LDAP queries. This allows an attacker who can supply crafted input to an application using LDAPStoreHelper to modify LDAP search filters, potentially bypassing search restrictions and manipulating directory results. The primary impact is loss of confidentiality and integrity of directory data, which could lead to unauthorized access or privilege escalation. The vulnerability affects BC-JAVA versions from 1.74 up to but not including 1.80.2, from 1.81 up to but not including 1.81.1, and from 1.82 up to but not including 1.84. Red Hat has released a security update in JBoss Enterprise Application Platform 8.1.6 for RHEL 8 that includes a fix for this issue. The recommended mitigation is to sanitize or escape LDAP special characters such as asterisks, parentheses, and backslashes in user input before passing it to LDAPStoreHelper.

The vulnerability allows remote attackers to perform LDAP injection by supplying crafted input to applications using LDAPStoreHelper for directory queries. This can lead to unauthorized disclosure of sensitive directory information and manipulation of LDAP query results, resulting in loss of confidentiality and integrity of directory data. The flaw may enable attackers to bypass search restrictions or escalate privileges by altering directory search behavior. There is no indication of availability impact or requirement for user interaction or privileges to exploit. No known exploits in the wild have been reported.

A security update fixing this vulnerability is available in Red Hat JBoss Enterprise Application Platform 8.1.6 for RHEL 8. Users should apply this update to remediate the issue. Additionally, to mitigate the vulnerability, all user-supplied input used in LDAP queries should be sanitized or escaped to neutralize LDAP special characters such as asterisks, parentheses, and backslashes before passing it to LDAPStoreHelper. If unexpected metacharacters are present, the input should be rejected or properly escaped. Following these steps will prevent LDAP injection attacks exploiting this flaw.