# bc-fips (Maven) vulnerabilities 15 known vulnerabilities (1 critical, 7 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data ## Advisories (15) ### [CVE-2026-13505](https://cve.now/CVE-2026-13505): Zeroisation of sensitive key material on garbage collection relies on finalization - Severity: High 8.7 - Published: Aug 8, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-8798](https://cve.now/CVE-2026-8798): Native entropy source retries the CPU entropy instructions without limit - Severity: High 8.7 - Published: Aug 8, 2026 - Affected: from 2.1.0, fixed in 2.1.3. ### [CVE-2026-13586](https://cve.now/CVE-2026-13586): PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) - Severity: Medium 5.3 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-13506](https://cve.now/CVE-2026-13506): Lazy ASN.1 sequence forcing resets nesting-depth guard - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-14682](https://cve.now/CVE-2026-14682): Possible OOM from unbounded up-front allocation on a definite-length read - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-58059](https://cve.now/CVE-2026-58059): Quadratic-time escaping when stringifying X.500 distinguished names - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-58060](https://cve.now/CVE-2026-58060): HSS public-key level count unbounded, enabling huge allocation on verify - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-58061](https://cve.now/CVE-2026-58061): CCM-family modes write plaintext to caller buffer before tag check - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-58062](https://cve.now/CVE-2026-58062): Stapled OCSP response accepted without binding to the checked certificate - Severity: Critical 9.3 - Published: Aug 3, 2026 - Affected: from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2026-58063](https://cve.now/CVE-2026-58063): BCFKS keystore load honours unbounded KDF cost from untrusted file - Severity: Medium 5.3 - Published: Aug 3, 2026 - Affected: from 1.0.0, fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. ### [CVE-2025-12194](https://cve.now/CVE-2025-12194): Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. - Severity: Medium 5.9 - Published: Oct 24, 2025 - Affected: from 2.1.0, through 2.1.1. ### [CVE-2025-9340](https://cve.now/CVE-2025-9340): native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output. - Severity: None 0.0 - Published: Aug 22, 2025 - Affected: from BC-FJA 2.1.0, through 2.1.0. ### [CVE-2025-9341](https://cve.now/CVE-2025-9341): Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion - Severity: Medium 5.9 - Published: Aug 22, 2025 - Affected: versions 2.1.0. ### [CVE-2025-9092](https://cve.now/CVE-2025-9092): Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion - Severity: Low 1.0 - Published: Aug 16, 2025 - Affected: from BC-FJA 2.1.0, through 2.1.0. ### [CVE-2025-8885](https://cve.now/CVE-2025-8885): Possible DOS in processing specially formed ASN.1 Object Identifiers - Severity: Medium 6.3 - Published: Aug 12, 2025 - Affected: from 1.0.0, through 1.0.2.5; from 2.0.0, through 2.0.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/bc-fips Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.