# org.bouncycastle:bc-fips (Maven) vulnerabilities 13 known vulnerabilities (1 critical, 4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.1.3 (Jul 19, 2026): no advisory affects it - Newest unaffected release: 2.1.3 (Jul 19, 2026), the latest release - Dependents: 178 - Releases: 16 since 1.0.0 (Jul 10, 2019) - Registry: https://central.sonatype.com/artifact/org.bouncycastle/bc-fips - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-13505: 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it) - CVE-2026-8798: 2.1.0 to 2.1.2 (2.1.3 is outside it) - CVE-2026-13506: 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it) - CVE-2026-8763: 1.0.0 to 1.0.2.6 (1.0.2.7 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 2.1.0 to 2.1.2 (2.1.3 is outside it) - CVE-2025-12194: 2.1.0 to 2.1.1 (2.1.2 is outside it) - CVE-2025-9340: 2.1.0 (2.1.1 is outside it) - CVE-2025-9341: 2.1.0 (2.1.1 is outside it) - CVE-2025-9092: 2.1.0 (2.1.1 is outside it) - CVE-2025-8885: 1.0.0 to 1.0.2.5 (1.0.2.6 is outside it); 2.0.0 (2.0.1 is outside it) - CVE-2024-29857: 1.0.0 to 1.0.2.4 (1.0.2.5 is outside it) - CVE-2022-45146: 1.0.0 to 1.0.2.3 (1.0.2.4 is outside it) - CVE-2020-15522: 1.0.0 to 1.0.2 (1.0.2.1 is outside it) - CVE-2020-26939: 1.0.0 to 1.0.1 (1.0.2 is outside it) ## Advisories (13) ### [CVE-2026-13505](https://cve.now/CVE-2026-13505): Zeroisation of sensitive key material on garbage collection relies on finalization - Severity: High 8.7 - Published: Aug 8, 2026 - Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. - Fixed in 1.0.2.7 (released Jul 12, 2026, 27 days before disclosure), 2.0.2 (released Jul 21, 2026, 18 days before disclosure) and 2.1.3 (released Jul 19, 2026, 20 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2026-8798](https://cve.now/CVE-2026-8798): Native entropy source retries the CPU entropy instructions without limit - Severity: High 8.7 - Published: Aug 8, 2026 - Affected: from 2.1.0, fixed in 2.1.3. - Fixed in 2.1.3 (released Jul 19, 2026, 20 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2026-13506](https://cve.now/CVE-2026-13506): Lazy ASN.1 sequence forcing resets nesting-depth guard - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. - Fixed in 1.0.2.7 (released Jul 12, 2026, 22 days before disclosure), 2.0.2 (released Jul 21, 2026, 13 days before disclosure) and 2.1.3 (released Jul 19, 2026, 15 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2026-8763](https://cve.now/CVE-2026-8763): Name Constraints bypass via trailing dot in rfc822Name and URI - Severity: Critical 9.3 - Published: Aug 3, 2026 - Affected: fixed in 1.0.2.7; from 2.0.0, fixed in 2.0.2; from 2.1.0, fixed in 2.1.3. - Fixed in 1.0.2.7 (released Jul 12, 2026, 22 days before disclosure), 2.0.2 (released Jul 21, 2026, 13 days before disclosure) and 2.1.3 (released Jul 19, 2026, 15 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2025-12194](https://cve.now/CVE-2025-12194): Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. - Severity: Medium 5.9 - Published: Oct 24, 2025 - Affected: from 2.1.0, fixed in 2.1.2. - Fixed in 2.1.2 (released Sep 22, 2025, 32 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2025-9340](https://cve.now/CVE-2025-9340): native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output. - Severity: None 0.0 - Published: Aug 22, 2025 - Affected: from 2.1.0, fixed in 2.1.1. - Fixed in 2.1.1 (released Aug 1, 2025, 21 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2025-9341](https://cve.now/CVE-2025-9341): Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion - Severity: Medium 5.9 - Published: Aug 22, 2025 - Affected: from 2.1.0, fixed in 2.1.1. - Fixed in 2.1.1 (released Aug 1, 2025, 21 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2025-9092](https://cve.now/CVE-2025-9092): Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion - Severity: Low 1.0 - Published: Aug 16, 2025 - Affected: from 2.1.0, fixed in 2.1.1. - Fixed in 2.1.1 (released Aug 1, 2025, 15 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2025-8885](https://cve.now/CVE-2025-8885): Possible DOS in processing specially formed ASN.1 Object Identifiers - Severity: Medium 6.3 - Published: Aug 12, 2025 - Affected: from 1.0.0, fixed in 1.0.2.6; from 2.0.0, fixed in 2.0.1. - Fixed in 1.0.2.6 (released Aug 16, 2025, 4 days after disclosure) and 2.0.1 (released Aug 21, 2025, 9 days after disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2024-29857](https://cve.now/CVE-2024-29857): An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA… - Severity: High 7.5 - Published: May 9, 2024 - Affected: fixed in 1.0.2.5. - Fixed in 1.0.2.5 (released Apr 26, 2024, 13 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2022-45146](https://cve.now/CVE-2022-45146): An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. - Severity: Unrated - Published: Nov 21, 2022 - Affected: fixed in 1.0.2.4. - Fixed in 1.0.2.4 (released Sep 28, 2023, 311 days after disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2020-15522](https://cve.now/CVE-2020-15522): Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue… - Severity: Unrated - Published: May 20, 2021 - Affected: fixed in 1.0.2.1. - Fixed in 1.0.2.1 (released Apr 29, 2021, 21 days before disclosure). - The latest release, 2.1.3, is not affected. ### [CVE-2020-26939](https://cve.now/CVE-2020-26939): In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private… - Severity: Unrated - Published: Nov 2, 2020 - Affected: fixed in 1.0.2. - Fixed in 1.0.2 (released Feb 24, 2020, 252 days before disclosure). - The latest release, 2.1.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.bouncycastle:bc-fips Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.