An LDAP injection vulnerability (CVE-2026-0636) exists in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library, specifically in the LDAPStoreHelper program files. This flaw affects versions 1.74 through 1.80.1, 1.81, and 1.82 through 1.83. The vulnerability allows improper neutralization of special elements in LDAP queries. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with potential confidentiality and integrity loss but no availability impact. Red Hat has issued security advisories with patches available for affected products.