What’s Vulnerable › Products

Legion of the Bouncy Castle Inc. BC-LTS-JAVA vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Legion of the Bouncy Castle Inc. BC-LTS-JAVA version is affected

Latest Legion of the Bouncy Castle Inc. BC-LTS-JAVA vulnerabilities

• CVE-2026-71884 — Packet CTR reports a full success length after the counter is exhausted (CVSS 8.2)
• CVE-2026-97873 — Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider (CVSS 5.3)
• CVE-2026-85515 — OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check (CVSS 8.2)
• CVE-2026-71889 — PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate (CVSS 8.7)
• CVE-2026-71888 — CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent (CVSS 8.7)
• CVE-2026-71883 — Native AES packet cipher returns the raw AES key on an alias (CVSS 8.2)
• CVE-2026-17508 — Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points (CVSS 5.3)