---
id: "CVE-2026-0636"
kind: "vulnerability"
aliases: ["CVE-2026-0636", "GHSA-c3fc-8qff-9hwx"]
title: "Bouncy Castle has an LDAP injection"
severity: "medium"
cvss: 6.5
epss: 0.00527
exploited: false
status: "open"
category: "package"
products: [{"name": "org.bouncycastle:bcprov-jdk14", "fixed": ["1.80.2"], "affected": ">= 1.74, < 1.80.2", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk15to18", "fixed": ["1.80.2"], "affected": ">= 1.74, < 1.80.2", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk18on", "fixed": ["1.80.2"], "affected": ">= 1.74, < 1.80.2", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk14", "fixed": ["1.81.1"], "affected": ">= 1.81, < 1.81.1", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk15to18", "fixed": ["1.81.1"], "affected": ">= 1.81, < 1.81.1", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk18on", "fixed": ["1.81.1"], "affected": ">= 1.81, < 1.81.1", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk14", "fixed": ["1.84"], "affected": ">= 1.82, < 1.84", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk15to18", "fixed": ["1.84"], "affected": ">= 1.82, < 1.84", "ecosystem": "maven"}, {"name": "org.bouncycastle:bcprov-jdk18on", "fixed": ["1.84"], "affected": ">= 1.82, < 1.84", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["bouncy-castle", "cwe-90", "gradle", "java", "ldap", "maven", "package"]
not_affected_if: ["fixed-version", "no-ldap-certificate-store", "no-untrusted-input"]
published_at: "2026-04-15T10:16:38+00:00"
first_seen_at: "2026-11-04T03:26:15+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c3fc-8qff-9hwx", "first_seen_at": "2026-11-04T03:26:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# Bouncy Castle has an LDAP injection

Bouncy Castle's Java cryptography library builds an LDAP query from input without neutralizing special characters, in the LDAPStoreHelper code. An attacker who controls that input can alter the LDAP query and read or match directory entries it should not reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.bouncycastle:bcprov-jdk14 affected >= 1.74, < 1.80.2 fixed 1.80.2
- maven:org.bouncycastle:bcprov-jdk15to18 affected >= 1.74, < 1.80.2 fixed 1.80.2
- maven:org.bouncycastle:bcprov-jdk18on affected >= 1.74, < 1.80.2 fixed 1.80.2
- maven:org.bouncycastle:bcprov-jdk14 affected >= 1.81, < 1.81.1 fixed 1.81.1
- maven:org.bouncycastle:bcprov-jdk15to18 affected >= 1.81, < 1.81.1 fixed 1.81.1
- maven:org.bouncycastle:bcprov-jdk18on affected >= 1.81, < 1.81.1 fixed 1.81.1
- maven:org.bouncycastle:bcprov-jdk14 affected >= 1.82, < 1.84 fixed 1.84
- maven:org.bouncycastle:bcprov-jdk15to18 affected >= 1.82, < 1.84 fixed 1.84
- maven:org.bouncycastle:bcprov-jdk18on affected >= 1.82, < 1.84 fixed 1.84

## How to check

- Look for `bcprov-jdk14`, `bcprov-jdk15to18` or `bcprov-jdk18on` in your Maven or Gradle dependency tree.
- Check the version: affected releases are 1.74 to 1.80.1, 1.81, and 1.82 to 1.83.
- Check whether the application uses the LDAP certificate store (LDAPStoreHelper) with untrusted input.

## Fix

- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.80 line: `1.80.2`
- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.81 line: `1.81.1`
- `bcprov-jdk14`, `bcprov-jdk15to18`, `bcprov-jdk18on` on the 1.82 to 1.83 line: `1.84`

## Timeline

- 2026-11-04T03:26:15+00:00 ghsa https://github.com/advisories/GHSA-c3fc-8qff-9hwx
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0636

## Documents

- [fix] Patch: github.com https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde

## From the sources

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

Issue affecting: BC 1.74 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83.

Fixed versions: BC 1.80.2, BC 1.81.1, BC 1.84

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_