- Latest release
- 1.70 (Dec 1, 2021): affected by 5 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 25 · 1 critical, 3 high, 1 medium
- Dependents
- 9,993
- Releases
- 26 since 1.46 (Mar 23, 2012)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-14813No published release is affectedNo published release is affected
- CVE-2024-29857Affects 1.46 to 1.70 (through the newest release)
- CVE-2024-30171Affects 1.46 to 1.70 (through the newest release)
- CVE-2024-34447Affects 1.61 to 1.70 (through the newest release)
- CVE-2023-33202Affects 1.46 to 1.70 (through the newest release)
- CVE-2023-33201Affects 1.49 to 1.70 (through the newest release)
- CVE-2020-15522Affects 1.46 to 1.65.01 (1.66 is outside it)
- CVE-2020-28052Affects 1.65 to 1.66 (1.67 is outside it)
- CVE-2020-26939Affects 1.46 to 1.60 (1.61 is outside it)
- CVE-2018-1000613Affects 1.57 to 1.59 (1.60 is outside it)
- CVE-2018-1000180Affects 1.46 to 1.59 (1.60 is outside it)
- CVE-2016-1000352Affects 1.46 to 1.55 (1.56 is outside it)
Show all 25 advisoriesShow fewer advisories
- CVE-2016-1000346Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000345Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000344Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000343Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000342Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000341Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000340Affects 1.51 to 1.55 (1.56 is outside it)
- CVE-2016-1000339Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2016-1000338Affects 1.46 to 1.55 (1.56 is outside it)
- CVE-2018-5382Affects 1.46 to 1.49 (1.50 is outside it)
- CVE-2017-13098No published release is affectedNo published release is affected
- CVE-2015-7940Affects 1.46 to 1.50 (1.51 is outside it)
- CVE-2013-1624Affects 1.46 to 1.47 (1.48 is outside it)
Advisories 25
- CVE-2025-14813Critical 9.3
GOSTCTR implementation unable to process more than 255 blocks correctly
Affected: through 1.7.0.
Fixed in 1.46 (released Mar 23, 2012, 5136 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 1.70, is not affected.
- CVE-2024-29857High 7.5
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA…
Affected: fixed in 1.78.
No fix released. The advisory names 1.78 as the fix, which the registry doesn't have yet. The latest release, 1.70, is still affected.
- CVE-2024-30171Medium 5.9
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.
Affected: fixed in 1.78.
No fix released. The advisory names 1.78 as the fix, which the registry doesn't have yet. The latest release, 1.70, is still affected.
- CVE-2024-34447High 7.5
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS)…
Affected: from 1.61, fixed in 1.78.
No fix released. The advisory names 1.78 as the fix, which the registry doesn't have yet. The latest release, 1.70, is still affected.
- CVE-2023-33202Unrated
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle…
Affected: all versions.
No fix released. The latest release, 1.70, is still affected.
- CVE-2023-33201Unrated
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
Affected: from 1.49, through 1.70.
No fix released. The latest release, 1.70, is still affected.
- CVE-2020-15522Unrated
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue…
Affected: fixed in 1.66.
Fixed in 1.66 (released Jul 7, 2020, 317 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2020-28052Unrated
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.
Affected: from 1.65, fixed in 1.67.
Fixed in 1.67 (released Nov 1, 2020, 47 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2020-26939Unrated
In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private…
Affected: fixed in 1.61.
Fixed in 1.61 (released Feb 11, 2019, 630 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2018-1000613Unrated
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use…
Affected: from 1.57, fixed in 1.60.
Fixed in 1.60 (released Jul 6, 2018, 3 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2018-1000180Unrated
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator…
Affected: fixed in 1.60.
Fixed in 1.60 (released Jul 6, 2018, 31 days after disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000352Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000346Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000345Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000344Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
Show all 25 advisoriesShow fewer advisories
- CVE-2016-1000343Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default…
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000342Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000341Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000340Unrated
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for…
Affected: from 1.51, fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000339Unrated
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine.
Affected: fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 528 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2016-1000338Unrated
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification.
Affected: from 1.38, fixed in 1.56.
Fixed in 1.56 (released Dec 23, 2016, 525 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2018-5382Unrated
Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
Affected: fixed in 1.50.
Fixed in 1.50 (released Dec 3, 2013, 1595 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2017-13098High 7.5
BouncyCastle JCE TLS Bleichenbacher/ROBOT
Affected: fixed in 1.0.3.
Fixed in 1.46 (released Mar 23, 2012, 2091 days before disclosure, the advisory names 1.0.3, which was never published).
The latest release, 1.70, is not affected.
- CVE-2015-7940Unrated
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote…
Affected: fixed in 1.51.
Fixed in 1.51 (released Jul 28, 2014, 469 days before disclosure).
The latest release, 1.70, is not affected.
- CVE-2013-1624Unrated
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing…
Affected: fixed in 1.48.
Fixed in 1.48 (released Feb 12, 2013, 4 days after disclosure).
The latest release, 1.70, is not affected.