bcgit/bc-java · Security
Bouncy Castle has an LDAP injection
- GHSA ID
- GHSA-c3fc-8qff-9hwx
- CVE ID
- CVE-2026-0636
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber
Description
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.84.
CWEs
- CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')