Most recent entries from all

bdu:2026-10867

certfr-2026-avi-0667 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0667

Withdrawn: CLEANSTART-2026-QQ48355 — Security fixes in kserve-modelmesh 0.12.0-r17

Withdrawn by the publisher.

Affected: CleanStart: kserve-modelmesh

Package kserve-modelmesh version 0.12.0-r17 fixes 53 vulnerabilities: ghsa-f6hv-jmp6-3vwv, ghsa-57rv-r2g8-2cj3, ghsa-xxqh-mfjm-7mv9, ghsa-m4cv-j2px-7723, ghsa-v8h7-rr48-vmmv...

EUVD-2026-371779

fkie_cve-2025-14813

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).

This vulnerability is associated with program files G3413CTRBlockCipher.

This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

GHSA-574f-3g2m-x479 — Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

Affected: Maven: org.bouncycastle:bcprov-jdk14, Maven: org.bouncycastle:bcprov-jdk15to18, Maven: org.bouncycastle:bcprov-jdk18on, Maven: org.bouncycastle:bcprov-debug-jdk14, Maven: org.bouncycastle:bcprov-debug-jdk15to18, Maven: org.bouncycastle:bcprov-debug-jdk18on, Maven: org.bouncycastle:bcprov-ext-jdk14, Maven: org.bouncycastle:bcprov-ext-jdk15to18, Maven: org.bouncycastle:bcprov-ext-jdk18on, Maven: org.bouncycastle:bcprov-ext-debug-jdk14 and 4 more

The GOST 28147-2015 CTR mode implementation (`G3413CTRBlockCipher`) in the Legion of the Bouncy Castle BC-JAVA `bcprov` core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

openSUSE-SU-2026:10571-1 — bouncycastle-1.84-1.1 on GA media

bouncycastle-1.84-1.1 on GA media

RHSA-2026:11720 — Red Hat Security Advisory: Red Hat build of Quarkus 3.20.6.SP1 security update

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

SUSE-SU-2026:21404-1 — Security update for bouncycastle

Security update for bouncycastle

UBUNTU-CVE-2025-14813

Affected: Ubuntu:Pro:16.04:LTS: bouncycastle, Ubuntu:Pro:18.04:LTS: bouncycastle, Ubuntu:Pro:20.04:LTS: bouncycastle, Ubuntu:Pro:22.04:LTS: bouncycastle, Ubuntu:Pro:24.04:LTS: bouncycastle, Ubuntu:25.10: bouncycastle, Ubuntu:26.04:LTS: bouncycastle

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

WID-SEC-W-2026-1129 — Bouncy Castle BC-JAVA: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle BC-JAVA ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.