MavenPackage

org.bouncycastle:bc-fips

13 known vulnerabilities (1 critical, 4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 2.1.3 (Jul 19, 2026): no advisory affects it
Newest unaffected release: 2.1.3 (Jul 19, 2026), the latest release
Advisories: 13 · 1 critical, 4 high, 3 medium, 1 low

Dependents: 178
Releases: 16 since 1.0.0 (Jul 10, 2019)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-13505
Affects 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it)
CVE-2026-8798
Affects 2.1.0 to 2.1.2 (2.1.3 is outside it)
CVE-2026-13506
Affects 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it)
CVE-2026-8763
Affects 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it)
CVE-2025-12194
Affects 2.1.0 to 2.1.1 (2.1.2 is outside it)
CVE-2025-9340
Affects 2.1.0 (2.1.1 is outside it)
CVE-2025-9341
Affects 2.1.0 (2.1.1 is outside it)
CVE-2025-9092
Affects 2.1.0 (2.1.1 is outside it)
CVE-2025-8885
Affects 1.0.0 to 1.0.2.5 (1.0.2.6 is outside it); 2.0.0 (2.0.1 is outside it)
CVE-2024-29857
Affects 1.0.0 to 1.0.2.4 (1.0.2.5 is outside it)
CVE-2022-45146
Affects 1.0.0 to 1.0.2.3 (1.0.2.4 is outside it)
CVE-2020-15522
Affects 1.0.0 to 1.0.2 (1.0.2.1 is outside it)
CVE-2020-26939
Affects 1.0.0 to 1.0.1 (1.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

CVE-2026-13505High 8.7
Zeroisation of sensitive key material on garbage collection relies on finalization
Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
Fixed in 1.0.2.7 (released Jul 12, 2026, 27 days before disclosure), 2.0.2 (released Jul 21, 2026, 18 days before disclosure) and 2.1.3 (released Jul 19, 2026, 20 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2026-8798High 8.7
Native entropy source retries the CPU entropy instructions without limit
Affected: from 2.1.0, fixed in 2.1.3.
Fixed in 2.1.3 (released Jul 19, 2026, 20 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2026-13506High 8.7
Lazy ASN.1 sequence forcing resets nesting-depth guard
Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
Fixed in 1.0.2.7 (released Jul 12, 2026, 22 days before disclosure), 2.0.2 (released Jul 21, 2026, 13 days before disclosure) and 2.1.3 (released Jul 19, 2026, 15 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2026-8763Critical 9.3
Name Constraints bypass via trailing dot in rfc822Name and URI
Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3.
Fixed in 1.0.2.7 (released Jul 12, 2026, 22 days before disclosure), 2.0.2 (released Jul 21, 2026, 13 days before disclosure) and 2.1.3 (released Jul 19, 2026, 15 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2025-12194Medium 5.9
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.
Affected: from 2.1.0, fixed in 2.1.2.
Fixed in 2.1.2 (released Sep 22, 2025, 32 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2025-9340None 0.0
native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.
Affected: from 2.1.0, fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 1, 2025, 21 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2025-9341Medium 5.9
Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion
Affected: from 2.1.0, fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 1, 2025, 21 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2025-9092Low 1.0
Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion
Affected: from 2.1.0, fixed in 2.1.1.
Fixed in 2.1.1 (released Aug 1, 2025, 15 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2025-8885Medium 6.3
Possible DOS in processing specially formed ASN.1 Object Identifiers
Affected: from 1.0.0, fixed in 1.0.2.6; from 2.0.0, fixed in 2.0.1.
Fixed in 1.0.2.6 (released Aug 16, 2025, 4 days after disclosure) and 2.0.1 (released Aug 21, 2025, 9 days after disclosure).
The latest release, 2.1.3, is not affected.
CVE-2024-29857High 7.5
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA…
Affected: fixed in 1.0.2.5.
Fixed in 1.0.2.5 (released Apr 26, 2024, 13 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2022-45146Unrated
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4.
Affected: fixed in 1.0.2.4.
Fixed in 1.0.2.4 (released Sep 28, 2023, 311 days after disclosure).
The latest release, 2.1.3, is not affected.
CVE-2020-15522Unrated
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue…
Affected: fixed in 1.0.2.1.
Fixed in 1.0.2.1 (released Apr 29, 2021, 21 days before disclosure).
The latest release, 2.1.3, is not affected.
CVE-2020-26939Unrated
In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private…
Affected: fixed in 1.0.2.
Fixed in 1.0.2 (released Feb 24, 2020, 252 days before disclosure).
The latest release, 2.1.3, is not affected.