ghsa-c3fc-8qff-9hwx
CVSS 5.5 osv_maven
Description
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. Issue affecting: BC 1.74 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83. Fixed versions: BC 1.80.2, BC 1.81.1, BC 1.84
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-0636
- https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde
- https://access.redhat.com/errata/RHSA-2026:11720
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60256
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/security/cve/CVE-2026-0636
- https://bugzilla.redhat.com/show_bug.cgi?id=2458641
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json
- https://access.redhat.com/errata/RHSA-2026:11721
- https://access.redhat.com/errata/RHSA-2026:13631
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:14276
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:60239
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60247
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk14",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk14"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.80.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk15to18",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.80.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.80.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.74",
"1.75",
"1.76",
"1.77",
"1.78",
"1.78.1",
"1.79",
"1.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk14",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk14"
},
"ranges": [
{
"events": [
{
"introduced": "1.81"
},
{
"fixed": "1.81.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.81"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk15to18",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18"
},
"ranges": [
{
"events": [
{
"introduced": "1.81"
},
{
"fixed": "1.81.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.81"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.81"
},
{
"fixed": "1.81.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.81"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk14",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk14"
},
"ranges": [
{
"events": [
{
"introduced": "1.82"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.82",
"1.83"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk15to18",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk15to18"
},
"ranges": [
{
"events": [
{
"introduced": "1.82"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.82",
"1.83"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on",
"purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.82"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.82",
"1.83"
]
}
],
"aliases": [
"CVE-2026-0636"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-18T01:06:02Z",
"nvd_published_at": "2026-04-15T10:16:38Z",
"severity": "MODERATE"
},
"details": "Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nIssue affecting: BC 1.74 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83.\n\nFixed versions: BC 1.80.2, BC 1.81.1, BC 1.84",
"id": "GHSA-c3fc-8qff-9hwx",
"modified": "2026-11-04T03:30:50.055788268Z",
"published": "2026-04-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11720"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:66488"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"type": "PACKAGE",
"url": "https://github.com/bcgit/bc-java"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13631"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14276"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21772"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53645"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53646"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber",
"type": "CVSS_V4"
}
],
"summary": "Bouncy Castle has an LDAP injection"
}