EUVD-2026-22849
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). LDAP Injection Vulnerability in LDAPStoreHelper.java
This issue affects BC-JAVA: from 1.49 before 1.84.
AnalysisAI
LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attackers to manipulate LDAP queries via specially crafted input to LDAPStoreHelper.java, enabling complete compromise of confidentiality, integrity, and availability across security boundaries. This critical vulnerability (CVSS 10.0) affects a widely deployed cryptographic library used throughout the Java ecosystem. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: identify all Java applications and dependencies using Bouncy Castle bcprov (versions 1.49-1.83) via software bill of materials (SBOM) or dependency scanning tools; flag systems using LDAP functionality for priority patching. Within 7 days: implement network segmentation to restrict LDAP query traffic to trusted sources only; enable request logging and anomaly detection on LDAP query patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today