BouncyCastle.Cryptography (NuGet)
Advisories
3
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.3.1 or later clears every advisory below that has a fix.
Upgrade commands
dotnet
dotnet add package BouncyCastle.Cryptography --version 2.3.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop |
High EPSS 0.75% |
< 2.3.1 | 2.3.1 |
| GHSA-v435-xc8x-wvr9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") |
Medium EPSS 0.90% |
< 2.3.1 | 2.3.1 |
| GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. |
High EPSS 1.10% |
< 2.3.1 | 2.3.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor