Update org.bouncycastle:1.76 to v1.84 [SECURITY]

[dwertent]

This PR contains the following updates:

Package	Type	Update	Change
org.bouncycastle:bcprov-jdk18on (source)	dependencies	minor	1.76 → 1.84
org.bouncycastle:bcpkix-jdk18on (source)	dependencies	minor	1.76 → 1.84

---

Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

CVE-2024-34447 / GHSA-4h8f-2wvx-gg5w

More information

Details

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-34447
• https://github.com/bcgit/bc-java/issues/1656
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
• https://www.bouncycastle.org/latest_releases.html
• http://security.netapp.com/advisory/ntap-20240614-0007

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle for Java on All (API modules) allows Excessive Allocation

CVE-2025-8885 / GHSA-67mf-3cr5-8w23

More information

Details

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-8885
• https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

CVE-2024-29857 / GHSA-8xfc-gm6g-vgpv

More information

Details

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-29857
• https://github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63
• https://github.com/bcgit/bc-java/commit/efc498ca4caa340ac2fe11f2efee06c1a294501f
• https://github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281
• https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857
• https://security.netapp.com/advisory/ntap-20241206-0008
• https://www.bouncycastle.org/latest_releases.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

CVE-2024-30172 / GHSA-m44j-cfrm-g8qc

More information

Details

An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-30172
• https://github.com/bcgit/bc-java/commit/1b9fd9b545e691bfb3941a9f6a797660c8860f02
• https://github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea49
• https://github.com/bcgit/bc-java/commit/ebe1c75579170072dc59b8dee2b55ce31663178f
• https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172
• https://security.netapp.com/advisory/ntap-20240614-0007
• https://www.bouncycastle.org/latest_releases.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

CVE-2024-30171 / GHSA-v435-xc8x-wvr9

More information

Details

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-30171
• https://github.com/bcgit/bc-csharp/commit/c984b8bfd8544dfc55dba91a02cbbbb9c580c217
• https://github.com/bcgit/bc-java/commit/d7d5e735abd64bf0f413f54fd9e495fc02400fb0
• https://github.com/bcgit/bc-java/commit/e0569dcb1dea9d421d84fc4c5c5688fe101afa2d
• https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171
• https://security.netapp.com/advisory/ntap-20240614-0008
• https://www.bouncycastle.org/latest_releases.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle has an LDAP injection

CVE-2026-0636 / GHSA-c3fc-8qff-9hwx

More information

Details

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.84.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0636
• https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle Has Covert Timing Channel Vulnerability

CVE-2026-5598 / GHSA-p93r-85wp-75v3

More information

Details

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.84.

Severity

• CVSS Score: 8.9 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:P/AU:Y/U:Red

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-5598
• https://github.com/bcgit/bc-java/commit/8692e6b2b191fc4aafa32545c7a78bdb9bf110c5
• https://github.com/bcgit/bc-java/commit/94abbd56413dfdac651fd878bc60253871ef5e87
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE-2026-5598

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

CVE-2025-8916 / GHSA-4cx2-fc23-5wg6

More information

Details

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-8916
• https://github.com/bcgit/bc-java/commit/310b30a4fbf36d13f6cc201ffa7771715641e67e
• https://github.com/bcgit/bc-java/commit/ff444a479942d88de64004dc82c3ee32a9e9075a
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908916

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

CVE-2026-5588 / GHSA-wg6q-6289-32hp

More information

Details

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

This issue affects BC-JAVA: from 1.49 before 1.84.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-5588
• https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[Copilot]

Pull request overview

Updates the project’s managed Bouncy Castle dependencies to address multiple published security advisories affecting older Bouncy Castle Java releases.

Changes:

• Bump org.bouncycastle managed dependency set from 1.76 to 1.84 for bcprov-jdk18on and bcpkix-jdk18on.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dwertent]

Closing: opened during a CVE-remediation test session on 2026-06-15; not needed (superseded by consolidated grouped/direct-only/severity-filtered config). Sorry for the noise.