CVE-2026-0636 is an LDAP injection vulnerability (CWE-90) in the BC-JAVA library by Legion of the Bouncy Castle Inc., affecting all prov modules from version 1.49 before 1.84. The vulnerability is due to improper neutralization of special elements in LDAP queries within LDAPStoreHelper.java, allowing attackers to manipulate LDAP queries. The CVSS 4.0 score is 10.0 (critical), reflecting a network exploitable flaw with no required privileges or user interaction and severe impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided. This vulnerability requires attention due to its critical nature and potential impact on applications using the affected BC-JAVA versions.

The vulnerability allows an attacker to perform LDAP injection attacks, which can lead to unauthorized access, modification, or disclosure of information stored in LDAP directories. Given the critical CVSS score of 10.0, successful exploitation could severely compromise the confidentiality, integrity, and availability of systems relying on the affected BC-JAVA library versions. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by restricting access to LDAP query interfaces, validating and sanitizing input data before it reaches the LDAPStoreHelper component, or upgrading to unaffected versions once they are released. Monitor official Legion of the Bouncy Castle Inc. communications for updates.