Skip to main content

LDAP CVE-2026-0636

| EUVDEUVD-2026-22849 MEDIUM
LDAP Injection (CWE-90)
2026-04-15 bcorg GHSA-c3fc-8qff-9hwx
Java LDAP Code Injection Bc Java Legion Of The Bouncy Castle Inc
5.5
CVSS 4.0 · Vendor: bcorg
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious LDAP query with special characters
  2. Delivery
    Submit query through vulnerable LDAPStoreHelper
  3. Exploit
    Inject unauthorized LDAP filter syntax
  4. Execution
    Bypass authentication or extract sensitive directory data
  5. Impact
    Modify or delete LDAP entries

Vulnerability Assessment

Weakness
CWE
CWE-90
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization LDAP query parameterization
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application uses Bouncy Castle BC-JAVA's LDAP certificate store or CRL retrieval functionality (LDAPStoreHelper.java) AND passes attacker-controllable data (such as certificate DN fields, user input strings, or HTTP parameters) into LDAP query construction without intermediate sanitization. This is NOT a default behavior-most BC-JAVA deployments use only cryptographic primitives and never invoke LDAP features. Vulnerable configurations typically involve custom PKI implementations, enterprise certificate validation systems integrated with corporate LDAP/Active Directory, or applications
Impact

This represents maximum theoretical severity (CVSS 10.0) with complete impact across all CIA triad dimensions and security scope change, indicating exploitation could compromise systems beyond the vulnerable component itself. The CVSS v4.0 vector confirms worst-case attack conditions: network-accessible, low complexity, no prerequisites, no user interaction. However, real-world risk is moderated by exploitation prerequisites-LDAP injection only manifests in code paths where applications use Bouncy Castle's LDAP certificate/CRL retrieval features and pass attacker-controllable input to these queries, which is NOT a default configuration for most BC-JAVA consumers who primarily use its cryptographic primitives. EPSS data not provided, but absence from CISA KEV indicates no confirmed active exploitation despite public disclosure. SSVC assessment: exploitation status is public (vendor advisory published), automatable is YES (network injection attacks are scriptable), technical impact is TOTAL (per CVSS scope change), but exploitation probability depends heavily on whether specific applications expose LDAP query construction to external input. This is a patch-immediately situation for applications using BC-JAVA's LDAP features, but lower priority for systems using only core cryptographic functions. The attack surface is narrower than CVSS 10.0 suggests, yet severity for affected code paths is genuine.
Exploit ScenarioDerived

An attacker identifies a Java web application that validates client certificates against an LDAP directory using Bouncy Castle 1.78. The application passes user-supplied certificate subject DN components to LDAPStoreHelper for validation. The attacker crafts a TLS client certificate with a subject DN containing LDAP injection metacharacters (e.g., cn=admin)(|(password=*)). When the application constructs an LDAP query like (cn=USER_INPUT), the unsanitized injection morphs it into (cn=admin)(|(password=*)), bypassing authentication logic or extracting sensitive directory attributes in the LDAP response. The attacker gains unauthorized access or exfiltrates user credentials from directory schema.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attackers to manipulate LDAP queries via specially crafted input to LDAPStoreHelper.java, enabling complete compromise of confidentiality, integrity, and availability across security boundaries. This critical vulnerability (CVSS 10.0) affects a widely deployed cryptographic library used throughout the Java ecosystem. No active exploitation confirmed (not in CISA KEV), but the attack r

Earlier versions of this analysis (1)
v1 Apr 15, 2026 - 12:40 CVSS 5.5

LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attackers to manipulate LDAP queries via specially crafted input to LDAPStoreHelper.java, enabling complete compromise of confidentiality, integrity, and availability across security boundaries. This critical vulnerability (CVSS 10.0) affects a widely deployed cryptographic library used throughout the Java ecosystem. No active exploitation confirmed (not in CISA KEV), but the attack requires no special conditions (AV:N/AC:L/PR:N/UI:N), making this an immediate patching priority for any Java application using Bouncy Castle's LDAP functionality.

RemediationAI

Upgrade BC-JAVA bcprov module to version 1.84 or later, which contains input validation fixes for LDAP query construction in LDAPStoreHelper.java. Organizations should inventory all Java applications and dependencies to identify embedded Bouncy Castle versions using dependency scanning tools (Maven dependency tree, Gradle dependencies, or SBOM analysis). For systems where immediate upgrade is not feasible, implement compensating controls by restricting network access to LDAP directory services, validating and sanitizing all external input before passing to certificate validation routines, and disabling LDAP-based certificate retrieval features if not operationally required. Review application logs for suspicious LDAP query patterns or unexpected directory access. Consult the official vendor security advisory at https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636 for additional mitigation guidance and technical details. Given the 35-version span of affected releases, prioritize patching based on whether applications actively use the LDAPStoreHelper functionality rather than just including the library.

Affected VersionsENISA

BC-JAVA 1.49 <1.84

Affected Packages

maven org.bouncycastle:bcprov-jdk14 fix: 1.84
maven org.bouncycastle:bcprov-jdk15to18 fix: 1.84
maven org.bouncycastle:bcprov-jdk18on fix: 1.84
euvd bc_java fix: 1.84

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Bouncy Castle BC-JAVA is a foundational cryptographic library for Java providing implementations of cryptographic algorithms, X.509 certificate handling, and PKI utilities. The vulnerability resides in LDAPStoreHelper.java within the provider (bcprov) module, which handles LDAP-based certificate and CRL retrieval operations. CWE-90 (LDAP Injection) occurs when user-controllable data is concatenated into LDAP query strings without proper sanitization of special LDAP metacharacters (parentheses, asterisks, null bytes, backslashes). Attackers can inject LDAP filter operators to bypass authentication checks, extract sensitive directory data, or modify query logic. The bcprov module is embedded in countless Java applications, middleware, and enterprise systems that perform certificate validation or directory operations. Affected CPE: cpe:2.3:a:legion_of_the_bouncy_castle_inc.:bc-java spanning a 35-version range (1.49 to 1.83), representing years of production deployments.

Know when LDAP gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (bcorg) PRIMARY 5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat 6.5 HIGH

Primary rating from Vendor (bcorg).

CVSS VectorVendor: bcorg

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
Severity Changed
Apr 15, 2026 - 15:22 NVD
CRITICAL MEDIUM
CVSS changed
Apr 15, 2026 - 15:22 NVD
10.0 (CRITICAL) 5.5 (MEDIUM)
Patch released
Apr 15, 2026 - 14:30 nvd
Patch available
CVE Published
Apr 15, 2026 - 08:59 nvd
MEDIUM 5.5

DescriptionCVE.org

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). LDAP Injection Vulnerability in LDAPStoreHelper.java

This issue affects BC-JAVA: from 1.49 before 1.84.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 5 maven packages depend on org.bouncycastle:bcprov-jdk14 (5 direct, 0 indirect)
  • 410 maven packages depend on org.bouncycastle:bcprov-jdk15to18 (27 direct, 383 indirect)
  • 1,370 maven packages depend on org.bouncycastle:bcprov-jdk18on (98 direct, 1,272 indirect)

Ecosystem-wide dependent count for version 1.74 and other introduced versions.

Executive ViewAI

Why It Matters

Bouncy Castle BC-JAVA versions 1.49-1.83 contain a critical LDAP injection vulnerability (CVSS 10.0) that enables unauthenticated remote attackers to compromise confidentiality, integrity, and availability of systems using this widely-deployed cryptographic library. Organizations running Java applications with affected Bouncy Castle versions face immediate risk of credential theft, data manipulation, and service disruption without vendor remediation currently available.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to LDAP services via firewall rules and VPN-only access; (2) Implement input validation and parameterized LDAP queries in application code to prevent injection; (3) Apply principle of least privilege to LDAP service accounts; (4) Enable detailed audit logging of LDAP queries and failed authentication attempts; (5) Consider isolating systems running affected Bouncy Castle versions from critical infrastructure until patched. Monitor https://github.com/bcgit/bc-java/releases for patch announcement.

Threat Intelligence Overview

EPSS Score
0.0%
Top 86% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2026-15723 HIGH POC
8.2 Oct 21

An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth S
CVE-2026-11748 MEDIUM POC
6.9 Jun 22

LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-0636 ADVISORY https://vuldb.com/vuln/357691 REF https://access.redhat.com/errata/RHSA-2026:11720 REF https://access.redhat.com/errata/RHSA-2026:11721 REF https://access.redhat.com/errata/RHSA-2026:13631 REF https://access.redhat.com/errata/RHSA-2026:14272 REF https://access.redhat.com/errata/RHSA-2026:14276 REF https://access.redhat.com/errata/RHSA-2026:17668 REF https://access.redhat.com/errata/RHSA-2026:18054 REF https://access.redhat.com/errata/RHSA-2026:18055 REF https://access.redhat.com/errata/RHSA-2026:18059 REF https://access.redhat.com/errata/RHSA-2026:21772 REF https://access.redhat.com/errata/RHSA-2026:53644 REF https://access.redhat.com/errata/RHSA-2026:53645 REF https://access.redhat.com/errata/RHSA-2026:53646 REF https://access.redhat.com/errata/RHSA-2026:53806 REF https://access.redhat.com/errata/RHSA-2026:60239 REF https://access.redhat.com/errata/RHSA-2026:60246 REF https://access.redhat.com/errata/RHSA-2026:60247 REF https://access.redhat.com/errata/RHSA-2026:60248 REF https://access.redhat.com/errata/RHSA-2026:60249 REF https://access.redhat.com/errata/RHSA-2026:60250 REF https://access.redhat.com/errata/RHSA-2026:60251 REF https://access.redhat.com/errata/RHSA-2026:60252 REF https://access.redhat.com/errata/RHSA-2026:60254 REF https://access.redhat.com/errata/RHSA-2026:60256 REF https://access.redhat.com/errata/RHSA-2026:60259 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/security/cve/CVE-2026-0636 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458641 REF https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy