# cve.now: Legion OF THE Bouncy Castle Inc.

The newest entries naming Legion OF THE Bouncy Castle Inc. as an affected vendor (up to 200), of 87 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-71884](https://cve.now/CVE-2026-71884.md): Packet CTR reports a full success length after the counter is exhausted (CVSS 8.2)
- [CVE-2026-71890](https://cve.now/CVE-2026-71890.md): MLS external commit can remove an arbitrary group member (CVSS 8.7)
- [CVE-2026-71891](https://cve.now/CVE-2026-71891.md): BLS12-381 key validation accepts a public key built on a foreign curve (CVSS 7.1)
- [CVE-2026-18040](https://cve.now/CVE-2026-18040.md): HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler (CVSS 5.9)
- [CVE-2026-71885](https://cve.now/CVE-2026-71885.md): MLS X.509 credential not bound to the LeafNode signature key (CVSS 9.2)
- [CVE-2026-71886](https://cve.now/CVE-2026-71886.md): OpenPGP certification accepted from a subkey without certification authority (CVSS 8.2)
- [CVE-2026-71887](https://cve.now/CVE-2026-71887.md): OpenPGP data signature accepted from a signing subkey without cross-certification (CVSS 8.2)
- [CVE-2026-71883](https://cve.now/CVE-2026-71883.md): Native AES packet cipher returns the raw AES key on an alias (CVSS 8.2)
- [CVE-2026-71888](https://cve.now/CVE-2026-71888.md): CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent (CVSS 8.7)
- [CVE-2026-71889](https://cve.now/CVE-2026-71889.md): PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate (CVSS 8.7)
- [CVE-2026-71892](https://cve.now/CVE-2026-71892.md): CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys (CVSS 6.9)
- [CVE-2026-85515](https://cve.now/CVE-2026-85515.md): OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check (CVSS 8.2)
- [CVE-2026-97873](https://cve.now/CVE-2026-97873.md): Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider (CVSS 5.3)
- [CVE-2026-18036](https://cve.now/CVE-2026-18036.md): NTRU leaks private key information by reducing secret values with a non-constant-time integer division (CVSS 8.2)
- [CVE-2026-17508](https://cve.now/CVE-2026-17508.md): Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points (CVSS 5.3)
- [CVE-2026-17507](https://cve.now/CVE-2026-17507.md): MLS membership checks compare a uint32 leaf\_index as signed, admitting an out-of-range sender (CVSS 8.7)
- [CVE-2026-103604](https://cve.now/CVE-2026-103604.md): Quadratic-time escaping when converting X.509 distinguished names to strings (CVSS 8.7)
- [CVE-2026-103603](https://cve.now/CVE-2026-103603.md): Unbounded HSS public key level count allows huge array allocation during signature verification (CVSS 8.7)
- [CVE-2026-103602](https://cve.now/CVE-2026-103602.md): Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts (CVSS 8.2)
- [CVE-2026-103601](https://cve.now/CVE-2026-103601.md): CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check (CVSS 8.2)
- [CVE-2026-103600](https://cve.now/CVE-2026-103600.md): Unbounded ASN.1 nesting depth causes process-terminating stack overflow (CVSS 8.7)
- [CVE-2026-63578](https://cve.now/CVE-2026-63578.md): Unbounded PBE iteration count when decrypting PKCS#8 private keys (CVSS 7.1)
- [CVE-2026-63577](https://cve.now/CVE-2026-63577.md): Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix (CVSS 8.2)
- [CVE-2026-63576](https://cve.now/CVE-2026-63576.md): URI name constraints checked against a mis-parsed host (CVSS 8.2)
- [CVE-2026-63575](https://cve.now/CVE-2026-63575.md): PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count (CVSS 7.1)
- [CVE-2026-63574](https://cve.now/CVE-2026-63574.md): Unbounded allocation from OpenPGP signature and user attribute subpacket lengths (CVSS 8.7)
- [CVE-2026-63573](https://cve.now/CVE-2026-63573.md): Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap (CVSS 8.2)
- [CVE-2026-63572](https://cve.now/CVE-2026-63572.md): Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files (CVSS 7.1)
- [CVE-2026-63571](https://cve.now/CVE-2026-63571.md): Attribute certificate path validation does not verify the attribute certificate's signature (CVSS 8.7)
- [CVE-2026-63570](https://cve.now/CVE-2026-63570.md): Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links (CVSS 7.1)
- [CVE-2026-63569](https://cve.now/CVE-2026-63569.md): MTI/A0 DHAgreement does not validate the peer's ephemeral value (CVSS 9.1)
- [CVE-2026-63568](https://cve.now/CVE-2026-63568.md): Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion (CVSS 8.7)
- [CVE-2026-63567](https://cve.now/CVE-2026-63567.md): IesEngine block-cipher mode checks padding before MAC (CBC padding oracle) (CVSS 8.2)
- [CVE-2026-63566](https://cve.now/CVE-2026-63566.md): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (CVSS 8.7)
- [CVE-2026-16001](https://cve.now/CVE-2026-16001.md): IesEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 8.2)
- [CVE-2026-16000](https://cve.now/CVE-2026-16000.md): KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used (CVSS 8.7)
- [CVE-2026-15999](https://cve.now/CVE-2026-15999.md): AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication (CVSS 8.2)
- [CVE-2026-13505](https://cve.now/CVE-2026-13505.md): Zeroisation of sensitive key material on garbage collection relies on finalization (CVSS 8.7)
- [CVE-2026-8798](https://cve.now/CVE-2026-8798.md): Native entropy source retries the CPU entropy instructions without limit (CVSS 8.7)
- [CVE-2026-13586](https://cve.now/CVE-2026-13586.md): PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) (CVSS 5.3)
- [CVE-2026-13506](https://cve.now/CVE-2026-13506.md): Lazy ASN.1 sequence forcing resets nesting-depth guard (CVSS 8.7)
- [CVE-2026-12860](https://cve.now/CVE-2026-12860.md): RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (CVSS 8.7)
- [CVE-2026-12852](https://cve.now/CVE-2026-12852.md): MLS wire decoder allocates attacker-declared opaque length before bounds check (CVSS 8.7)
- [CVE-2026-12817](https://cve.now/CVE-2026-12817.md): OpenPGP AEAD decryption skips final tag on chunk-aligned data (CVSS 8.7)
- [CVE-2026-12816](https://cve.now/CVE-2026-12816.md): IESEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 8.7)
- [CVE-2026-12803](https://cve.now/CVE-2026-12803.md): KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) (CVSS 8.7)
- [CVE-2026-12802](https://cve.now/CVE-2026-12802.md): CMS AuthEnvelopedData fails to enforce tag-length on decryption (CVSS 8.7)
- [CVE-2026-14682](https://cve.now/CVE-2026-14682.md): Possible OOM from unbounded up-front allocation on a definite-length read (CVSS 8.7)
- [CVE-2026-58059](https://cve.now/CVE-2026-58059.md): Quadratic-time escaping when stringifying X.500 distinguished names (CVSS 8.7)
- [CVE-2026-58060](https://cve.now/CVE-2026-58060.md): HSS public-key level count unbounded, enabling huge allocation on verify (CVSS 8.7)
- [CVE-2026-58061](https://cve.now/CVE-2026-58061.md): CCM-family modes write plaintext to caller buffer before tag check (CVSS 8.7)
- [CVE-2026-58062](https://cve.now/CVE-2026-58062.md): Stapled OCSP response accepted without binding to the checked certificate (CVSS 9.3)
- [CVE-2026-58063](https://cve.now/CVE-2026-58063.md): BCFKS keystore load honours unbounded KDF cost from untrusted file (CVSS 5.3)
- [CVE-2026-59638](https://cve.now/CVE-2026-59638.md): JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (CVSS 9.3)
- [CVE-2026-59639](https://cve.now/CVE-2026-59639.md): CMS verifySignatures returns true for SignedData with zero signers (CVSS 8.7)
- [CVE-2026-59640](https://cve.now/CVE-2026-59640.md): OpenPGP CFB quick-check oracle active on symmetric/session-key paths (CVSS 8.7)
- [CVE-2026-59641](https://cve.now/CVE-2026-59641.md): S/MIME validator trusts signer-asserted signingTime for path validation (CVSS 8.7)
- [CVE-2026-59642](https://cve.now/CVE-2026-59642.md): CMS AuthenticatedData content not bound to MAC when authAttrs present (CVSS 8.7)
- [CVE-2026-59643](https://cve.now/CVE-2026-59643.md): OpenPGP inline-signature policy failures silently ignored (CVSS 8.7)
- [CVE-2026-59644](https://cve.now/CVE-2026-59644.md): MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (CVSS 8.7)
- [CVE-2026-59645](https://cve.now/CVE-2026-59645.md): OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (CVSS 8.7)
- [CVE-2026-59646](https://cve.now/CVE-2026-59646.md): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (CVSS 8.7)
- [CVE-2026-59647](https://cve.now/CVE-2026-59647.md): CRMF/CMP password-MAC honours unbounded iteration count (CVSS 6.9)
- [CVE-2026-59648](https://cve.now/CVE-2026-59648.md): OpenPGP Argon2 S2K honours attacker-chosen memory and passes (CVSS 6.9)
- [CVE-2026-59649](https://cve.now/CVE-2026-59649.md): OpenPGP user-attribute subpacket length bounded only by JVM max memory (CVSS 8.7)
- [CVE-2026-59650](https://cve.now/CVE-2026-59650.md): MTI/A0 DH agreement exponentiates unvalidated peer value (CVSS 9.3)
- [CVE-2026-59651](https://cve.now/CVE-2026-59651.md): BKS keystore accepts legacy version with 16-bit integrity MAC key (CVSS 7.1)
- [CVE-2026-59652](https://cve.now/CVE-2026-59652.md): LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (CVSS 6.9)
- [CVE-2026-12185](https://cve.now/CVE-2026-12185.md): BKS/UBER keystore allocates from untrusted lengths before integrity check (CVSS 7.1)
- [CVE-2026-8763](https://cve.now/CVE-2026-8763.md): Name Constraints bypass via trailing dot in rfc822Name and URI (CVSS 9.3)
- [CVE-2026-15055](https://cve.now/CVE-2026-15055.md): PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (CVSS 5.3)
- [CVE-2024-14041](https://cve.now/CVE-2024-14041.md): ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) (CVSS 8.2)
- [CVE-2026-15997](https://cve.now/CVE-2026-15997.md): Native ARM SHA3 / SHAKE \`restoreFullState\` fails to detect size\_t underflow in a crafted encoded state (CVSS 1.7)
- [CVE-2026-8149](https://cve.now/CVE-2026-8149.md): GCM chunking can lead to bad tag exception on decryption (CVSS 5.1)
- [CVE-2026-3505](https://cve.now/CVE-2026-3505.md): Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. (CVSS 8.7)
- [CVE-2026-5588](https://cve.now/CVE-2026-5588.md): PKIX draft CompositeVerifier accepts empty signature sequence as valid. (CVSS 6.3)
- [CVE-2026-5598](https://cve.now/CVE-2026-5598.md): Non-constant time comparisons risk private key leakage in FrodoKEM. (CVSS 8.9)
- [CVE-2026-0636](https://cve.now/CVE-2026-0636.md): LDAP Injection Vulnerability in LDAPStoreHelper.java (CVSS 5.5)
- [CVE-2025-14813](https://cve.now/CVE-2025-14813.md): GOSTCTR implementation unable to process more than 255 blocks correctly (CVSS 9.3)
- [CVE-2025-12194](https://cve.now/CVE-2025-12194.md): Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. (CVSS 5.9)
- [CVE-2025-9340](https://cve.now/CVE-2025-9340.md): native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output. (CVSS 0.0)
- [CVE-2025-9341](https://cve.now/CVE-2025-9341.md): Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion (CVSS 5.9)
- [CVE-2025-9092](https://cve.now/CVE-2025-9092.md): Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion (CVSS 1.0)
- [CVE-2025-8916](https://cve.now/CVE-2025-8916.md): Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer (CVSS 6.3)
- [CVE-2025-8885](https://cve.now/CVE-2025-8885.md): Possible DOS in processing specially formed ASN.1 Object Identifiers (CVSS 6.3)
- [CVE-2018-5382](https://cve.now/CVE-2018-5382.md): Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions (no CVSS)
- [CVE-2017-13098](https://cve.now/CVE-2017-13098.md): BouncyCastle JCE TLS Bleichenbacher/ROBOT (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/legion-of-the-bouncy-castle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.