MavenPackage

org.bouncycastle:bcprov-lts8on

4 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-13506High 8.7
Lazy ASN.1 sequence forcing resets nesting-depth guard
Affected: fixed in 2.73.12.
Fixed in 2.73.12 (released Jul 16, 2026, 18 days before disclosure).
The latest release, 2.73.13, is not affected.
CVE-2026-8763Critical 9.3
Name Constraints bypass via trailing dot in rfc822Name and URI
Affected: fixed in 2.73.12.
Fixed in 2.73.12 (released Jul 16, 2026, 18 days before disclosure).
The latest release, 2.73.13, is not affected.
CVE-2026-8149Medium 5.1
GCM chunking can lead to bad tag exception on decryption
Affected: from 2.73.0, fixed in 2.73.11.
Fixed in 2.73.11 (released May 8, 2026, the day of disclosure).
The latest release, 2.73.13, is not affected.
CVE-2024-34447High 7.5
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS)…
Affected: fixed in 2.73.6.
Fixed in 2.73.6 (released Apr 7, 2024, 26 days before disclosure).
The latest release, 2.73.13, is not affected.