MavenPackage

org.bouncycastle:bcprov-jdk15to18

15 known vulnerabilities (2 critical, 5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 1.86 (Sep 11, 2026): no advisory affects it
Newest unaffected release: 1.86 (Sep 11, 2026), the latest release
Advisories: 15 · 2 critical, 5 high, 3 medium

Dependents: 36
Releases: 27 since 1.63 (Sep 11, 2019)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-13506
Affects 1.63 to 1.84 (1.85 is outside it)
CVE-2026-8763
Affects 1.63 to 1.84 (1.85 is outside it)
CVE-2026-5598
Affects 1.71 to 1.80 (1.81 is outside it)
CVE-2026-0636
Affects 1.74 to 1.83 (1.84 is outside it)
CVE-2025-14813
Affects 1.63 to 1.83 (1.84 is outside it)
CVE-2025-8885
Affects 1.63 to 1.77 (1.78 is outside it)
CVE-2024-29857
Affects 1.63 to 1.77 (1.78 is outside it)
CVE-2024-30172
Affects 1.73 to 1.77 (1.78 is outside it)
CVE-2024-30171
Affects 1.63 to 1.77 (1.78 is outside it)
CVE-2024-34447
Affects 1.63 to 1.77 (1.78 is outside it)
CVE-2023-33202
Affects 1.63 to 1.72 (1.73 is outside it)
CVE-2023-33201
Affects 1.63 to 1.73 (1.74 is outside it)

Show all 15 advisoriesShow fewer advisories

CVE-2020-15522
Affects 1.63 to 1.65 (1.66 is outside it)
CVE-2020-28052
Affects 1.65 to 1.66 (1.67 is outside it)
CVE-2020-26939
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

CVE-2026-13506High 8.7
Lazy ASN.1 sequence forcing resets nesting-depth guard
Affected: fixed in 1.85.
Fixed in 1.85 (released Jul 11, 2026, 23 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2026-8763Critical 9.3
Name Constraints bypass via trailing dot in rfc822Name and URI
Affected: fixed in 1.85.
Fixed in 1.85 (released Jul 11, 2026, 23 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2026-5598High 8.9
Non-constant time comparisons risk private key leakage in FrodoKEM.
Affected: from 1.71, fixed in 1.80.2.
Fixed in 1.81 (released Jun 4, 2025, 315 days before disclosure, the advisory names 1.80.2, which was never published).
The latest release, 1.86, is not affected.
CVE-2026-0636Medium 5.5
LDAP Injection Vulnerability in LDAPStoreHelper.java
Affected: from 1.74, fixed in 1.84.
Fixed in 1.84 (released Apr 14, 2026, 1 day before disclosure).
The latest release, 1.86, is not affected.
CVE-2025-14813Critical 9.3
GOSTCTR implementation unable to process more than 255 blocks correctly
Affected: from 1.59, through 1.80.1; versions 1.81.0; from 1.82, fixed in 1.84.
Fixed in 1.84 (released Apr 14, 2026, 1 day before disclosure).
The latest release, 1.86, is not affected.
CVE-2025-8885Medium 6.3
Possible DOS in processing specially formed ASN.1 Object Identifiers
Affected: from 1.0, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 493 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-29857High 7.5
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA…
Affected: fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-30172High 7.5
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.
Affected: from 1.73, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-30171Medium 5.9
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.
Affected: fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-34447High 7.5
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS)…
Affected: from 1.61, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 27 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2023-33202Unrated
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle…
Affected: fixed in 1.73.
Fixed in 1.73 (released Apr 12, 2023, 225 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2023-33201Unrated
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
Affected: fixed in 1.74.
Fixed in 1.74 (released Jun 15, 2023, 20 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2020-15522Unrated
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue…
Affected: fixed in 1.66.
Fixed in 1.66 (released Jul 8, 2020, 316 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2020-28052Unrated
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.
Affected: from 1.65, fixed in 1.67.
Fixed in 1.67 (released Nov 1, 2020, 47 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2020-26939Unrated
In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private…
Affected: fixed in 1.61.
Fixed in 1.63 (released Sep 11, 2019, 418 days before disclosure, the advisory names 1.61, which was never published).
The latest release, 1.86, is not affected.