Threats affecting pkg:maven/org.bouncycastle/bc-java

Bouncy Castle for Java versions before 1.86 contain a vulnerability in their MLS implementation where a 32-bit unsigned leaf index is incorrectly handled as a signed integer. This causes certain out-of-range sender values to bypass membership checks, enabling a denial of service via heap exhaustion. The issue is fixed by interpreting the leaf index as unsigned, rejecting invalid values.

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.