The vulnerability CVE-2026-0636 in BC-JAVA is an LDAP injection flaw due to improper neutralization of special elements in LDAP queries within the LDAPStoreHelper component. This allows potential manipulation of LDAP queries by an unauthenticated attacker over the network. The affected versions are BC-JAVA from 1.74 up to but not including 1.80.2, from 1.81 up to but not including 1.81.1, and from 1.82 up to but not including 1.84. The issue has a CVSS 4.0 score of 5.5 (medium severity). Red Hat has released multiple advisories and errata referencing this vulnerability as part of security updates for Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8. The advisories indicate the vulnerability is addressed in updated packages, but the exact fixed versions or remediation level are not explicitly detailed in the provided vendor advisory content.

This LDAP injection vulnerability could allow an attacker to manipulate LDAP queries, potentially leading to unauthorized information disclosure or modification within LDAP directory services. The CVSS score of 5.5 reflects a medium impact with network attack vector, no privileges or user interaction required, and low complexity. There are no known exploits in the wild at this time according to the provided data.

Red Hat has issued security advisories and errata that include fixes for this vulnerability in their JBoss Enterprise Application Platform 8.1 for RHEL 8. Users should apply the relevant Red Hat security updates and errata to remediate this issue. Before applying updates, ensure all previously released errata are applied and back up existing installations. Patch status is not explicitly confirmed in the provided content; therefore, users should consult the referenced Red Hat advisories for the latest remediation guidance and fixed package versions.