{"id":"CVE-2026-0636","kind":"vulnerability","aliases":["CVE-2026-0636","GHSA-c3fc-8qff-9hwx"],"related":[],"title":"Bouncy Castle has an LDAP injection","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nIssue affecting: BC 1.74 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83.\n\nFixed versions: BC 1.80.2, BC 1.81.1, BC 1.84","summary":"Bouncy Castle's Java cryptography library builds an LDAP query from input without neutralizing special characters, in the LDAPStoreHelper code. An attacker who controls that input can alter the LDAP query and read or match directory entries it should not reach.","severity":"medium","cvss":6.5,"epss":0.00527,"exploited":false,"exploited_at":null,"products":[{"name":"org.bouncycastle:bcprov-jdk14","fixed":["1.80.2"],"affected":">= 1.74, < 1.80.2","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk15to18","fixed":["1.80.2"],"affected":">= 1.74, < 1.80.2","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.80.2"],"affected":">= 1.74, < 1.80.2","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk14","fixed":["1.81.1"],"affected":">= 1.81, < 1.81.1","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk15to18","fixed":["1.81.1"],"affected":">= 1.81, < 1.81.1","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.81.1"],"affected":">= 1.81, < 1.81.1","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk14","fixed":["1.84"],"affected":">= 1.82, < 1.84","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk15to18","fixed":["1.84"],"affected":">= 1.82, < 1.84","ecosystem":"maven"},{"name":"org.bouncycastle:bcprov-jdk18on","fixed":["1.84"],"affected":">= 1.82, < 1.84","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["bouncy-castle","cwe-90","gradle","java","ldap","maven","package"],"not_affected_if":["fixed-version","no-ldap-certificate-store","no-untrusted-input"],"how_to_check":"- Look for `bcprov-jdk14`, `bcprov-jdk15to18` or `bcprov-jdk18on` in your Maven or Gradle dependency tree.\n- Check the version: affected releases are 1.74 to 1.80.1, 1.81, and 1.82 to 1.83.\n- Check whether the application uses the LDAP certificate store (LDAPStoreHelper) with untrusted input.","fix":"- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.80 line: `1.80.2`\n- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.81 line: `1.81.1`\n- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.82 to 1.83 line: `1.84`","status":"open","published_at":"2026-04-15T10:16:38+00:00","first_seen_at":"2026-11-04T03:26:15+00:00","triaged_at":"2026-11-04T03:26:26+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T03:26:26Z","model":"claude-haiku-5-5","output":{"fix":"- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.80 line: `1.80.2`\n- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.81 line: `1.81.1`\n- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.82 to 1.83 line: `1.84`","reach":"network","title":"Bouncy Castle: LDAP query injection in certificate store helper","impact":"medium","summary":"Bouncy Castle's Java cryptography library builds an LDAP query from input without neutralizing special characters, in the LDAPStoreHelper code. An attacker who controls that input can alter the LDAP query and read or match directory entries it should not reach.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","maven","gradle","bouncy-castle","ldap"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker alters LDAP queries and reads unauthorized directory entries","analyst_note":"","how_to_check":"- Look for `bcprov-jdk14`, `bcprov-jdk15to18` or `bcprov-jdk18on` in your Maven or Gradle dependency tree.\n- Check the version: affected releases are 1.74 to 1.80.1, 1.81, and 1.82 to 1.83.\n- Check whether the application uses the LDAP certificate store (LDAPStoreHelper) with untrusted input.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-ldap-certificate-store","no-untrusted-input"],"who_is_affected":"Only Java applications that pull in a Bouncy Castle provider module in the affected version ranges are exposed, and only if they build LDAP queries from input the attacker can influence through the certificate store code path. Applications that do not use the LDAP certificate store, or that use only fixed versions, can skip it. The sources do not say which default configurations reach LDAPStoreHelper.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000859,"input_tokens":4649,"output_tokens":789,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0636':9A,17A '-2026':8A,16A '-90':58B '1.74':144C '1.80.1':146C '1.80.2':157C '1.81':148C '1.81.1':159C '1.82':150C '1.83':153C '1.84':161C '8qff':13A '9hwx':14A 'affect':142C 'alter':91B 'associ':136C 'attack':85B 'bc':126C,143C,147C,149C,152C,156C,158C,160C 'bc-java':125C 'bcprov':20A,24A,28A,32A,36A,40A,44A,48A,52A,128C 'bcprov-jdk14':19A,31A,43A 'bcprov-jdk15to18':23A,35A,47A 'bcprov-jdk18on':27A,39A,51A 'bounci':1A,55B,64B,122C 'bouncy-castl':54B 'build':70B 'c3fc':12A 'castl':2A,56B,65B,123C 'charact':79B 'code':83B 'control':87B 'cryptographi':68B 'cve':7A,15A 'cwe':57B 'directori':99B 'element':109C 'entri':100B 'file':139C 'fix':154C 'ghsa':11A 'ghsa-c3fc-8qff-9hwx':10A 'gradl':59B 'improp':105C 'inc':124C 'inject':6A,116C 'input':75B,89B 'issu':141C 'java':60B,67B,127C 'jdk14':21A,33A,45A 'jdk15to18':25A,37A,49A 'jdk18on':29A,41A,53A 'ldap':5A,61B,72B,93B,113C,115C 'ldapstorehelp':82B,140C 'legion':119C 'librari':69B 'match':98B 'maven':62B 'modul':132C 'neutral':77B,106C 'org.bouncycastle':18A,22A,26A,30A,34A,38A,42A,46A,50A 'packag':63B 'program':138C 'prov':131C 'queri':73B,94B,114C 'reach':104B 'read':96B 'special':78B,108C 'use':110C 'version':155C 'vulner':117C,134C 'without':76B","nicknames":[],"mitigations":[],"who_affected":"Only Java applications that pull in a Bouncy Castle provider module in the affected version ranges are exposed, and only if they build LDAP queries from input the attacker can influence through the certificate store code path. Applications that do not use the LDAP certificate store, or that use only fixed versions, can skip it. The sources do not say which default configurations reach LDAPStoreHelper.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orgbouncycastlebcprovjdk14","orgbouncycastlebcprovjdk15to18","orgbouncycastlebcprovjdk18on"],"ptokens":["bcprov","bouncycastle","jdk14","jdk15to18","jdk18on","org"],"labels":["bouncycastle","cwe90","gradle","java","ldap","maven","medium","package"],"campaign_type":null,"first_public_at":"2026-04-15T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c3fc-8qff-9hwx","url":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","severity":"medium","published_at":"2026-04-17T18:31:50+00:00","modified_at":"2026-11-04T03:24:31+00:00","first_seen_at":"2026-11-04T03:26:15+00:00","fetched_at":"2026-11-04T03:31:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-0636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","severity":null,"published_at":"2026-04-15T10:16:38+00:00","modified_at":"2026-10-26T21:10:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63578,"url":"https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}