- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 15 · 1 critical, 7 high, 5 medium, 1 low
Advisories 15
- CVE-2026-13505High 8.7
Zeroisation of sensitive key material on garbage collection relies on finalization
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-8798High 8.7
Native entropy source retries the CPU entropy instructions without limit
Affected: from 2.1.0, fixed in 2.1.3.
- CVE-2026-13586Medium 5.3
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-13506High 8.7
Lazy ASN.1 sequence forcing resets nesting-depth guard
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-14682High 8.7
Possible OOM from unbounded up-front allocation on a definite-length read
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-58059High 8.7
Quadratic-time escaping when stringifying X.500 distinguished names
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-58060High 8.7
HSS public-key level count unbounded, enabling huge allocation on verify
Affected: from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-58061High 8.7
CCM-family modes write plaintext to caller buffer before tag check
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-58062Critical 9.3
Stapled OCSP response accepted without binding to the checked certificate
Affected: from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2026-58063Medium 5.3
BCFKS keystore load honours unbounded KDF cost from untrusted file
Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
- CVE-2025-12194Medium 5.9
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.
Affected: from 2.1.0, through 2.1.1.
- CVE-2025-9340None 0.0
native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.
Affected: from BC-FJA 2.1.0, through 2.1.0.
- CVE-2025-9341Medium 5.9
Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion
Affected: versions 2.1.0.
- CVE-2025-9092Low 1.0
Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion
Affected: from BC-FJA 2.1.0, through 2.1.0.
- CVE-2025-8885Medium 6.3
Possible DOS in processing specially formed ASN.1 Object Identifiers
Affected: from 1.0.0, through 1.0.2.5; from 2.0.0, through 2.0.1.