Bouncy Castle for Java versions before 1.86 and before 2.73.13 in the LTS branch contain a vulnerability in their legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 password-based encryption (PBE) implementations. These implementations accept an iteration count for key derivation from untrusted input without proper bounds checking, allowing a small input to cause an arbitrary amount of computational work before verification. This can lead to denial-of-service conditions due to excessive CPU usage. The issue is addressed by bounding iteration counts under a configurable property and rejecting out-of-range values.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the OpenPGP certificate API where third-party certifications or trust delegations could be accepted from subkeys lacking proper certification authority flags. This flaw allows a subkey without the CERTIFY_OTHER flag to issue valid-looking certifications or trust delegations, misleading applications into trusting attacker-controlled identities. The vulnerability does not forge primary key signatures or expose private keys but elevates the authority of compromised subkeys, undermining key-flag based containment. The issue is fixed by requiring that only the primary key or subkeys with the CERTIFY_OTHER flag can issue third-party certifications or delegations. No known exploits are reported in the wild.
Bouncy Castle for Java versions before 1.86 contain a vulnerability where truncated OpenPGP encrypted messages are accepted without error, leading to missing integrity checks on certain decryption paths. On the SEIPD version 1 path, this results in plaintext being delivered without any integrity verification, allowing altered ciphertext to produce accepted but modified plaintext. On the AEAD path, truncated chunks cause silent dropping of subsequent packets without error, potentially causing signed and encrypted messages to be read as unsigned. The low-level API remains unaffected if PGPEncryptedData.verify() is called directly. This issue also affects certain LTS and FIPS versions on the AEAD route. The vulnerability is a residual effect of a previous CVE and has been addressed in version 1.86 and later.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the high-level OpenPGP API where it incorrectly accepts data signatures made by signing subkeys lacking the required embedded Primary Key Binding signature. This causes misattribution of genuine signatures to attacker-controlled certificates, potentially misleading verifiers about the signature's origin. The issue arises because the subkey inherits signing capability improperly when the Subkey Binding signature omits a Key Flags subpacket, violating RFC 9580 requirements. The low-level API is unaffected. This vulnerability does not allow private key recovery or signature forgery but enables attackers to bind a victim's public subkey to their own primary key, causing signature misattribution.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the BLS12_381BasicScheme.keyValidate method and related classes that accept public keys constructed on non-canonical elliptic curves with a forged cofactor. This flaw allows an attacker to create a phantom signer in aggregate signature verification by passing a public key that is not a valid G1 point but is accepted due to insufficient curve validation. The issue only arises if an application explicitly constructs ECPoints on non-standard curves; the standard compressed-point decoder is unaffected.
Bouncy Castle for Java versions before 1.86 and certain LTS and FIPS versions contain a vulnerability in the streaming CMS AuthenticatedData parser. The parser incorrectly accepts messages where the digestAlgorithm and authAttrs fields disagree about the presence of authenticated attributes, allowing an attacker to insert unauthenticated attributes into a message. This could lead to applications acting on attacker-chosen attribute values, although the content itself remains protected by the MAC.
Bouncy Castle for Java versions before 1.86 contains a vulnerability in the validation of MLS (RFC 9420) external commit proposal lists. The flaw allows an external joiner to remove any member from the group and take over their slot in the ratchet tree by exploiting improper validation of Remove proposals. This occurs because the validation did not ensure that the removed leaf was related to the joiner, and the credential check was missing except in a limited test harness. The issue is fixed by requiring the removed leaf's credential to match the joiner's new leaf credential on both sending and receiving sides.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the Messaging Layer Security (MLS) implementation where an X.509 credential is not properly bound to a LeafNode's signature key. This allows an attacker to present another party's certificate as their credential while signing with an unrelated key, potentially impersonating that party. The vulnerability affects deployments that accept external commits without independent credential admission checks. The issue is fixed by requiring the end-entity certificate's public key to match the signature key as per RFC 9420 section 5.3. Deployments using only basic credentials are not affected.
Bouncy Castle for Java versions before 1.86 have a flaw in the opt-in key-size validation for CMS key-transport recipients when using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The validation check fails due to an incorrect comparison between a byte array and an ASN1ObjectIdentifier, causing the key size check to be skipped. This allows acceptance of EnvelopedData or AuthEnvelopedData messages with mismatched key sizes despite validation being enabled. The issue also affects Bouncy Castle for Java FIPS versions before bcpkix-fips 2.0.13 and 2.1.13. Non-HKDF messages and recipients without validation enabled are not affected.
Bouncy Castle for Java versions before 1.85 have an unbounded HSS public-key level count, which can lead to excessive memory allocation during verification. This vulnerability also affects Bouncy Castle for Java LTS versions before 2.73.12 and Bouncy Castle for Java FIPS versions before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Bouncy Castle for Java versions before 1.85 and certain LTS and FIPS versions have a vulnerability causing quadratic-time escaping when stringifying X.500 distinguished names. This performance issue can lead to high resource consumption during processing. The vulnerability is identified as CWE-407 and is rated with high severity.
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, have a vulnerability in CCM-family encryption modes where plaintext is written to the caller's buffer before the authentication tag is verified. This behavior can lead to potential exposure of plaintext data if the tag check fails.
Bouncy Castle for Java versions prior to 1.85 and certain LTS and FIPS versions improperly honor an unbounded key derivation function (KDF) cost parameter from untrusted BCFKS keystore files during load. This vulnerability could lead to resource exhaustion or denial of service due to excessive computational cost. The issue affects Bouncy Castle for Java, including LTS versions before 2.73.12 and FIPS versions before bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2.1.3 (2.1.X). No known exploits are reported in the wild. The severity is assessed as medium based on available data.
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability is associated with program files G3413CTRBlockCipher.
This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.