Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

bcpg-fips

5 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 4 high, 1 medium

Advisories 5

  • OpenPGP AEAD decryption skips final tag on chunk-aligned data

    Affected: from 1.0.7, fixed in 1.0.13; from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.13.

  • OpenPGP CFB quick-check oracle active on symmetric/session-key paths

    Affected: from 1.0.0, fixed in 1.0.13; from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.13.

  • OpenPGP inline-signature policy failures silently ignored

    Affected: from 2.0.12, fixed in 2.0.13.

  • CVE-2026-59648Medium 6.9

    OpenPGP Argon2 S2K honours attacker-chosen memory and passes

    Affected: from 1.0.6, fixed in 1.0.13; from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.13.

  • OpenPGP user-attribute subpacket length bounded only by JVM max memory

    Affected: from 1.0.0, fixed in 1.0.13; from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.13.