Bouncycastle Fips Java Api — known CVE vulnerabilities

Every CVE whose affected-product data names Bouncycastle Fips Java Api, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (14)

• CVE-2026-58062 — CVSS 9.1 (critical): In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects…
• CVE-2026-8763 — CVSS 9.1 (critical): In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy…
• CVE-2026-14682 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects…
• CVE-2026-13586 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy…
• CVE-2018-1000180 — CVSS 7.5 (high): Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator…
• CVE-2026-58059 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy…
• CVE-2026-58060 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects…
• CVE-2026-58061 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy…
• CVE-2026-13506 — CVSS 7.5 (high): In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for…
• CVE-2020-15522 — CVSS 5.9 (medium): Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue…
• CVE-2022-45146 — CVSS 5.5 (medium): An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and…
• CVE-2023-33202 — CVSS 5.5 (medium): Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMP…
• CVE-2020-26939 — CVSS 5.3 (medium): In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private…
• CVE-2026-58063 — CVSS 5.3 (medium): In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy…