Skip to main content

Bouncy Castle bc-java EUVDEUVD-2026-52022

| CVE-2026-59652 MEDIUM
LDAP Injection (CWE-90)
2026-08-03 bcorg GHSA-mf66-6236-xhfw
LDAP Java Code Injection Bc Java Red Hat
6.9
CVSS 4.0 · Vendor: bcorg
Share

Severity by source

Vendor (bcorg) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vuln.today AI
4.8 MEDIUM

AV:N because attacker delivers crafted certificate remotely; AC:H because LDAP cert store configuration and bcprov-jdk14 usage are non-default prerequisites; C:L/I:L for limited LDAP query manipulation; A:N as no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (bcorg).

CVSS VectorVendor: bcorg

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 03, 2026 - 01:39 vuln.today
Analysis Generated
Aug 03, 2026 - 01:39 vuln.today

DescriptionCVE.org

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

AnalysisAI

LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft certificate with LDAP metacharacters in CN
Delivery
Deliver certificate to target application (TLS client cert or repository fetch)
Exploit
Application invokes bcprov-jdk14 LDAPStoreHelper for path building or CRL lookup
Execution
Unescaped CN concatenated into DirContext.search() filter
Persist
Injected filter predicate alters LDAP query results
Impact
Attacker manipulates certificate or CRL resolution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three specific conditions to be simultaneously true. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) reflects unauthenticated network access with low-complexity exploitation and limited confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker in a position to present a crafted X.509 certificate - for example, as a client certificate in a TLS handshake, or by publishing a certificate to a repository the server fetches - embeds LDAP metacharacters in the certificate's Subject CN field (e.g., CN=a)(userPassword=*). When a Java application using bcprov-jdk14 performs certification-path building or CRL lookup that triggers LDAPStoreHelper, the unescaped CN value is concatenated into the DirContext.search() filter, rewriting the LDAP query and potentially leaking directory entries or bypassing certificate validation logic. …
Remediation Upgrade to Bouncy Castle bc-java 1.85 or later, which applies RFC 2254 LDAP filter escaping in the jdk1.4 LDAPStoreHelper.parseDN method (patch commit: https://github.com/bcgit/bc-java/commit/27c468af54ee6c6af87eab5a3a8468dce17e24a0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
CVE-2021-43350 CRITICAL
9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
CVE-2026-21880 MEDIUM POC
5.3 Jan 08

Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au

Same weakness CWE-90 – LDAP Injection

View all
CVE-2016-9299 CRITICAL POC
9.8
CVE-2017-14596 CRITICAL POC
9.8
CVE-2017-8790 CRITICAL POC
9.8
CVE-2023-28853 MEDIUM POC
6.5
CVE-2026-44930 CRITICAL
9.8
CVE-2024-33868 CRITICAL
9.8
CVE-2023-6905 CRITICAL
9.8
CVE-2021-43350 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-52022 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy