What’s Vulnerable › Vulnerabilities

CVE-2023-33201

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-05 · updated 2026-06-17
• Weakness: CWE-295

Description

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Affected products

• Legion of the Bouncy Castle Inc. BC-JAVA: before 1.74 — fixed in 1.74

How to fix

Upgrade to a fixed version: Legion of the Bouncy Castle Inc. BC-JAVA 1.74. Check the vendor advisory for mitigations.

References

• https://bouncycastle.org
• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
• https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html
• https://security.netapp.com/advisory/ntap-20230824-0008/
• https://bouncycastle.org
• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
• https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html
• https://security.netapp.com/advisory/ntap-20230824-0008/

Get alerted when CVE-2023-33201 or the next vulnerability affects your stack