GHSA-c3fc-8qff-9hwx CVE-2026-0636
Bouncy Castle has an LDAP injection
Medium
Maven
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.68% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
- Fix
- Available
- 3 packages have a fixed version
Description
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.84.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.bouncycastle:bcprov-jdk14 | >= 1.74, < 1.84 |
1.84 |
| org.bouncycastle:bcprov-jdk15to18 | >= 1.74, < 1.84 |
1.84 |
| org.bouncycastle:bcprov-jdk18on | >= 1.74, < 1.84 |
1.84 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.bouncycastle:bcprov-jdk14 Maven → 1.84
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk14</artifactId><version>1.84</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk14:1.84")
org.bouncycastle:bcprov-jdk15to18 Maven → 1.84
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15to18</artifactId><version>1.84</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15to18:1.84")
org.bouncycastle:bcprov-jdk18on Maven → 1.84
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk18on</artifactId><version>1.84</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk18on:1.84")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Packages
Other links
- github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde
- github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636
- access.redhat.com/errata/RHSA-2026:11720
- access.redhat.com/errata/RHSA-2026:11721
- access.redhat.com/errata/RHSA-2026:13631
- access.redhat.com/errata/RHSA-2026:14272
- access.redhat.com/errata/RHSA-2026:14276
- access.redhat.com/errata/RHSA-2026:17668
- access.redhat.com/errata/RHSA-2026:18054
- access.redhat.com/errata/RHSA-2026:18055
- access.redhat.com/errata/RHSA-2026:18059
- access.redhat.com/errata/RHSA-2026:21772
- access.redhat.com/errata/RHSA-2026:53644
- access.redhat.com/errata/RHSA-2026:53645
- access.redhat.com/errata/RHSA-2026:53646
- access.redhat.com/errata/RHSA-2026:60239
- access.redhat.com/errata/RHSA-2026:60246
- access.redhat.com/errata/RHSA-2026:60247
- access.redhat.com/errata/RHSA-2026:60248
- access.redhat.com/errata/RHSA-2026:60249
- access.redhat.com/errata/RHSA-2026:60250
- access.redhat.com/errata/RHSA-2026:60251
- access.redhat.com/errata/RHSA-2026:60252
- access.redhat.com/errata/RHSA-2026:60254
- access.redhat.com/errata/RHSA-2026:60256
- access.redhat.com/errata/RHSA-2026:60259
- access.redhat.com/errata/RHSA-2026:66488
- access.redhat.com/security/cve/CVE-2026-0636
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p93r-85wp-75v3 Bouncy Castle Has Covert Timing Channel Vulnerability | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-574f-3g2m-x479 Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-67mf-3cr5-8w23 Bouncy Castle for Java on All (API modules) allows Excessive Allocation | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-v435-xc8x-wvr9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-4h8f-2wvx-gg5w Bouncy Castle Java Cryptography API vulnerable to DNS poisoning | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-wjxj-5m7g-mg7q Bouncy Castle Denial of Service (DoS) | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor