- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
The project offers to open a security advisory crediting you, and optionally to list you in Contributors.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 5 excluded.
Web 1
- https://www.bouncycastle.org
Products and areas 12
- CMS, S/MIME, PKCS#7, PKCS#12 and the certificate management protocols the project implements, including CMP and EST
- The ASN.1 layer underneath all of the above, which decodes attacker-supplied structure before any signature has been checked
- The FIPS distributions and their self-test and boundary machinery
- The JCE and JCA provider surface: every algorithm registered through it, and the parameter handling on the way in
- The lightweight API, which callers use directly to reach primitives without going through the provider framework
- The OpenPGP implementation and everything it parses, which handles data supplied entirely by a third party
- The PKIX stack: certificate parsing, path building and validation, name constraints, CRL and OCSP handling
- The public key implementations across RSA, DSA, the elliptic curve families, the national algorithm suites such as GOST and SM2, and the post-quantum algorithms the project has added
- The published policy asks for security reports at the dedicated mailbox and commits to opening an advisory. It sets out a workflow rather than a component boundary, so treat the whole provider as in scope across both the Java and C# distributions
- The symmetric ciphers and their modes, including the AEAD constructions, tag verification and the counter and IV handling that recent findings landed in
- The TLS and DTLS implementation and the JSSE provider built on it, covering handshake state, the record layer and the trust decisions in between
- The utility and encoding surface, including the base64, hex and PEM handling that parses input a caller did not produce
Out of scope (5)
- Application misuse of the API where the documented contract was broken, such as supplying a repeated IV to a mode that requires a unique one
- Forks and repackaged copies of Bouncy Castle maintained by someone else, including a platform vendor's derived version
- Reports filed as public GitHub issues, since the project asks for security reports at the dedicated mailbox
- The JDK's own bundled providers or the .NET platform's cryptography APIs rather than Bouncy Castle's implementations
- Weaknesses in a standardised algorithm rather than in this implementation of it
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report by email to the address on the policy page , the dedicated security mailbox the project publishes
-
Say which distribution the finding is in, bc-java or bc-csharp, and check the other one before reporting.
-
Name the JDK or .NET target and the provider registration.
-
State whether the FIPS distribution is affected.
Not accepted
-
Application misuse of the API where the documented contract was broken
-
Weaknesses in a standardised algorithm rather than in this implementation of it
-
Forks and repackaged copies of Bouncy Castle maintained by someone else
-
Reports filed as public GitHub issues
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 22 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-63575 | Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, to cause a denial of service through CPU exhaustion via an iteration count of zero or below, becaus | High 7.1 | 2 Oct 2026 |
| CVE-2026-63576 | Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose p | High 8.2 | 2 Oct 2026 |
| CVE-2026-63577 | Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get certificates accepted by PKIX path validation whose subject distinguished name, or a directoryName subjectAlt | High 8.2 | 2 Oct 2026 |
| CVE-2026-63578 | Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS#8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVATE KEY" PEM file, to cause a denial of service through CPU exhaustion via an iteration count close to | High 7.1 | 2 Oct 2026 |
| CVE-2026-63570 | Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificat | High 7.1 | 2 Oct 2026 |
| CVE-2026-63571 | Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as valid, and so obtain whatever roles or privileges an application grants on the strength of its attri | High 8.7 | 2 Oct 2026 |
| CVE-2026-63572 | Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file to cause a denial of service through CPU exhaustion via an iteration count close to 2^31 in the file's MacData or in the PBE parameters of an encrypted SafeContents or shrouded key bag, because the co | High 7.1 | 2 Oct 2026 |
| CVE-2026-63573 | Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to re | High 8.2 | 2 Oct 2026 |
| CVE-2026-63574 | Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote, unauthenticated attacker who can supply a crafted OpenPGP public key, certificate or signature to cause a denial of service (OutOfMemoryE | High 8.7 | 2 Oct 2026 |
| CVE-2026-103601 | Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, be | High 8.2 | 2 Oct 2026 |
| CVE-2026-103602 | Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation for email addresses, DNS names or URI hosts that lie within excluded subtrees applying to that CA, via an | High 8.2 | 2 Oct 2026 |
| CVE-2026-103603 | Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level cou | High 8.7 | 2 Oct 2026 |
| CVE-2026-103604 | Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request or other structure whose name contains a long attribute value made up | High 8.7 | 2 Oct 2026 |
| CVE-2026-17507 | In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validate | High 8.7 | 2 Oct 2026 |
| CVE-2026-103600 | Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements (for example SEQUENCE inside SEQUENCE, in definite-length DER or indefinite-length BER form), because each nesting level is p | High 8.7 | 2 Oct 2026 |
| CVE-2026-16001 | Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plaintext to forge shorter messages of their choosing that the recipient accepts as authentic, via a crafted | High 8.2 | 2 Oct 2026 |
| CVE-2026-63566 | Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated DTLS peer to cause a denial of service through memory exhaustion via crafted handshake message fragments, because the reassembly buffer for each incoming handshake message was allocated at th | High 8.7 | 2 Oct 2026 |
| CVE-2026-63567 | Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padd | High 8.2 | 2 Oct 2026 |
| CVE-2026-63568 | Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a CMP message or CRMF certificate request whose PBMParameter declares a very large iteration count, because PKMacBuilder enforced it | High 8.7 | 2 Oct 2026 |
| CVE-2026-63569 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the sma | Critical 9.1 | 2 Oct 2026 |
| CVE-2026-15999 | Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declare an authentication tag (aes-ICVlen) of zero or another length outside the RFC 5084 set, because CcmP | High 8.2 | 2 Oct 2026 |
| CVE-2026-16000 | Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypted without associated data. The cause is that the G1 block, which binds the nonce, the message length | High 8.7 | 2 Oct 2026 |
| CVE-2026-14682 | In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24. | High 8.7 | 3 Aug 2026 |
| CVE-2026-13586 | In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | Medium 5.3 | 3 Aug 2026 |
| CVE-2026-12852 | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check. | High 8.7 | 3 Aug 2026 |
| CVE-2026-12860 | In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | High 8.7 | 3 Aug 2026 |
| CVE-2026-13506 | In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-12803 | In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12. | High 8.7 | 3 Aug 2026 |
| CVE-2026-12816 | In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | High 8.7 | 3 Aug 2026 |
| CVE-2026-12817 | In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-12802 | In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-58061 | In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-58062 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | Critical 9.3 | 3 Aug 2026 |
| CVE-2026-58063 | In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | Medium 5.3 | 3 Aug 2026 |
| CVE-2026-58059 | In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-58060 | In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59652 | In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper. | Medium 6.9 | 3 Aug 2026 |
| CVE-2026-8763 | In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | Critical 9.3 | 3 Aug 2026 |
| CVE-2026-59645 | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59646 | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59647 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | Medium 6.9 | 3 Aug 2026 |
| CVE-2026-59648 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | Medium 6.9 | 3 Aug 2026 |
| CVE-2026-59649 | In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59650 | In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | Critical 9.3 | 3 Aug 2026 |
| CVE-2026-59651 | In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | High 7.1 | 3 Aug 2026 |
| CVE-2026-59638 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series). | Critical 9.3 | 3 Aug 2026 |
| CVE-2026-59639 | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59640 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59641 | In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59642 | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | High 8.7 | 3 Aug 2026 |
| CVE-2026-59643 | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13. | High 8.7 | 3 Aug 2026 |
| CVE-2026-59644 | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. | High 8.7 | 3 Aug 2026 |
| CVE-2026-12185 | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | High 7.1 | 3 Aug 2026 |
| CVE-2026-15055 | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | Medium 5.3 | 3 Aug 2026 |
| CVE-2024-14041 | In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term | High 8.2 | 28 Jul 2026 |
| CVE-2023-33202 | Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service a | Medium 5.5 | 23 Nov 2023 |
| CVE-2023-33201 | Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. | Medium 5.3 | 5 Jul 2023 |
| CVE-2022-45146 | An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because th | Medium 5.5 | 21 Nov 2022 |
| CVE-2020-15522 | Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. | Medium 5.9 | 20 May 2021 |
| CVE-2020-28052 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. | High 8.1 | 18 Dec 2020 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months Cryptographic weakness 40 % Side channel / timing 25 % Injection 20 % Resource exhaustion 15 % Latest advisories Loading the feed Overview Bouncy Castle is the cryptography provider Java and .NET software reaches for when the platform's own APIs fall short. It is the default provider across a large amount of JVM enterprise software, parts of it were carried into Android, and its FIPS builds run in regulated deployments where the alternative is a hardware module. GHSA-574f-3g2m-x479 is the reference point: a keystream reuse defect in GOST CTR mode, meaning a cipher that quietly stopped encrypting. The Legion of the Bouncy Castle is a real corporate entity and it offers advisory credit rather than money. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for security reports at the dedicated mailbox and commits to opening an advisory. It sets out a workflow rather than a component boundary, so treat the whole provider as in scope across both the Java and C# distributions The JCE and JCA provider surface: every algorithm registered through it, and the parameter handling on the way in The lightweight API, which callers use directly to reach primitives without going through the provider framework The symmetric ciphers and their modes, including the AEAD constructions, tag verification and the counter and IV handling that recent findings landed in The public key implementations across RSA, DSA, the elliptic curve families, the national algorithm suites such as GOST and SM2, and the post-quantum algorithms the project has added The PKIX stack: certificate parsing, path building and validation, name constraints, CRL and OCSP handling CMS, S/MIME, PKCS#7, PKCS#12 and the certificate management protocols the project implements, including CMP and EST The OpenPGP implementation and everything it parses, which handles data supplied entirely by a third party The TLS and DTLS implementation and the JSSE provider built on it, covering handshake state, the record layer and the trust decisions in between The ASN.1 layer underneath all of the above, which decodes attacker-supplied structure before any signature has been checked The FIPS distributions and their self-test and boundary machinery The utility and encoding surface, including the base64, hex and PEM handling that parses input a caller did not produce Out of scope The JDK's own bundled providers or the .NET platform's cryptography APIs rather than Bouncy Castle's implementations Application misuse of the API where the documented contract was broken, such as supplying a repeated IV to a mode that requires a unique one Weaknesses in a standardised algorithm rather than in this implementation of it Forks and repackaged copies of Bouncy Castle maintained by someone else, including a platform vendor's derived version Reports filed as public GitHub issues, since the project asks for security reports at the dedicated mailbox Most-valued findings Anything that makes a cipher stop encrypting. GHSA-574f-3g2m-x479 reused the keystream in GOST CTR mode, which produces ciphertext that looks correct and protects nothing Signature or certificate verification that accepts what it should reject, anywhere in PKIX, CMS or OpenPGP, since this library is the verification path for a great deal of enterprise document and code signing Timing and other side channel signals in the primitive implementations, the class GHSA-p93r-85wp-75v3 landed in, which matter on shared JVM hosting where an attacker runs beside the victim Injection through a component that builds a query or a name from parsed material. GHSA-c3fc-8qff-9hwx was LDAP injection reached through this library rather than through the application above it Algorithmic complexity and unbounded allocation on parsed input, the shape GHSA-67mf-3cr5-8w23 took, which on a JVM service is a remote denial of service against the whole process ASN.1 decoder defects generally, because everything above it, certificates, CMS structures and OpenPGP packets, is decoded before it is authenticated Anything that breaks a FIPS build's boundary or lets a self-test pass over an implementation that is not producing correct output A defect present in both bc-java and bc-csharp, which doubles the blast radius and is common given how much design the two distributions share Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report by email to [email protected] , the dedicated security mailbox the project publishes GitHub private vulnerability reporting is switched off on bcgit/bc-java , so email is the only private intake and the advisory button is not available Say which distribution the finding is in, bc-java or bc-csharp, and check the other one before reporting. The two share design and a great many algorithm implementations, so a defect in one is often present in both Name the JDK or .NET target and the provider registration. Behaviour differs between the JCE provider, the lightweight API and the FIPS builds, and a finding may only exist in one of them State whether the FIPS distribution is affected. Those builds are certified artefacts used in regulated deployments and a defect there carries a certification consequence as well The project offers to open a security advisory crediting you, and optionally to list you in Contributors. There is no payment to negotiate Disclosure Coordinated by email with the maintainers and published as a GitHub Security Advisory that credits the reporter. The April 2026 pattern shows three advisories going out on a single day, so expect fixes to be batched into a release rather than published one at a time. Enterprise JVM consumers upgrade a crypto provider slowly and the FIPS builds slower still, so hold the detail past the release date rather than to it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability