MavenPackage

org.bouncycastle:bcprov-jdk18on

12 known vulnerabilities (2 critical, 5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 1.86 (Sep 11, 2026): no advisory affects it
Newest unaffected release: 1.86 (Sep 11, 2026), the latest release
Advisories: 12 · 2 critical, 5 high, 3 medium

Dependents: 5,663
Releases: 21 since 1.71 (Apr 6, 2022)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-13506
Affects 1.71 to 1.84 (1.85 is outside it)
CVE-2026-8763
Affects 1.71 to 1.84 (1.85 is outside it)
CVE-2026-5598
Affects 1.71 to 1.80 (1.80.2 is outside it); 1.81 to 1.83 (1.84 is outside it)
CVE-2026-0636
Affects 1.74 to 1.83 (1.84 is outside it)
CVE-2025-14813
Affects 1.71 to 1.80 (1.80.2 is outside it); 1.81 (1.81.1 is outside it); 1.82 to 1.83 (1.84 is outside it)
CVE-2025-8885
Affects 1.71 to 1.77 (1.78 is outside it)
CVE-2024-29857
Affects 1.71 to 1.77 (1.78 is outside it)
CVE-2024-30172
Affects 1.73 to 1.77 (1.78 is outside it)
CVE-2024-30171
Affects 1.71 to 1.77 (1.78 is outside it)
CVE-2024-34447
Affects 1.71 to 1.77 (1.78 is outside it)
CVE-2023-33202
Affects 1.71 to 1.72 (1.73 is outside it)
CVE-2023-33201
Affects 1.71 to 1.73 (1.74 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

CVE-2026-13506High 8.7
Lazy ASN.1 sequence forcing resets nesting-depth guard
Affected: fixed in 1.85.
Fixed in 1.85 (released Jul 12, 2026, 22 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2026-8763Critical 9.3
Name Constraints bypass via trailing dot in rfc822Name and URI
Affected: fixed in 1.85.
Fixed in 1.85 (released Jul 12, 2026, 22 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2026-5598High 8.9
Non-constant time comparisons risk private key leakage in FrodoKEM.
Affected: from 1.82, fixed in 1.84; from 1.81, fixed in 1.84; from 1.71, fixed in 1.80.2.
Fixed in 1.80.2 (released May 15, 2026, 30 days after disclosure) and 1.84 (released Apr 14, 2026, 1 day before disclosure).
The latest release, 1.86, is not affected.
CVE-2026-0636Medium 5.5
LDAP Injection Vulnerability in LDAPStoreHelper.java
Affected: from 1.74, fixed in 1.84.
Fixed in 1.84 (released Apr 14, 2026, 1 day before disclosure).
The latest release, 1.86, is not affected.
CVE-2025-14813Critical 9.3
GOSTCTR implementation unable to process more than 255 blocks correctly
Affected: from 1.59, fixed in 1.80.2; from 1.81.0, fixed in 1.81.1; from 1.82, fixed in 1.84.
Fixed in 1.80.2 (released May 15, 2026, 30 days after disclosure), 1.81.1 (released May 15, 2026, 30 days after disclosure) and 1.84 (released Apr 14, 2026, 1 day before disclosure).
The latest release, 1.86, is not affected.
CVE-2025-8885Medium 6.3
Possible DOS in processing specially formed ASN.1 Object Identifiers
Affected: from 1.0, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 493 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-29857High 7.5
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA…
Affected: fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-30172High 7.5
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78.
Affected: from 1.73, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-30171Medium 5.9
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78.
Affected: fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 33 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2024-34447High 7.5
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS)…
Affected: from 1.61, fixed in 1.78.
Fixed in 1.78 (released Apr 6, 2024, 27 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2023-33202Unrated
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle…
Affected: fixed in 1.73.
Fixed in 1.73 (released Apr 12, 2023, 225 days before disclosure).
The latest release, 1.86, is not affected.
CVE-2023-33201Unrated
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
Affected: fixed in 1.74.
Fixed in 1.74 (released Jun 15, 2023, 20 days before disclosure).
The latest release, 1.86, is not affected.