en
Legion of the Bouncy Castle Inc. is an Australian nonprofit organization that maintains and supports the Bouncy Castle cryptography project. It operates in application security and cryptographic software, providing portable APIs and FIPS-oriented implementations for Java and.NET applications used by a global developer community.
As of 10/25/2026, Legion of the Bouncy Castle Inc. recorded 72 security vulnerabilities in the last 90 days across 4 products, including 62 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, BC-JAVA had the most security vulnerabilities in the Legion of the Bouncy Castle Inc. ecosystem, with 47 vulnerabilities—approximately 65.28% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-71884Packet CTR reports a full success length after the counter is exhaustedCVE-2026-71890MLS external commit can remove an arbitrary group memberCVE-2026-71891BLS12-381 key validation accepts a public key built on a foreign curveCVE-2026-18040HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight samplerCVE-2026-71885MLS X.509 credential not bound to the LeafNode signature key| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-71884Packet CTR reports a full success length after the counter is exhausted | Exploitation statusNot exploited | FixYes |
| Published10/09/2026 |
| SeverityHigh |
CVE-2026-71890MLS external commit can remove an arbitrary group member | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-71891BLS12-381 key validation accepts a public key built on a foreign curve | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-18040HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-71885MLS X.509 credential not bound to the LeafNode signature key | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityCritical |
|---|
CVE-2026-71886OpenPGP certification accepted from a subkey without certification authority | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-71887OpenPGP data signature accepted from a signing subkey without cross-certification | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-71883Native AES packet cipher returns the raw AES key on an alias | Exploitation statusNot exploited | FixYes | Affected productBC-LTS-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-71888CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-71889PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate | Exploitation statusNot exploited | FixYes | Affected productBC-JAVA | Published10/03/2026 | SeverityHigh |
|---|
85 Results | Page 1 of 9