Most recent entries from all

Withdrawn: CLEANSTART-2026-AV84730 — Security fixes for CVE-2026-1605, CVE-2026-22732, CVE-2026-24281, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-20…

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-371753

fkie_cve-2026-3505

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).

This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

GHSA-cj8j-37rh-8475 — Bouncy Castle Uncontrolled Resource Consumption vulnerability

Affected: Maven: org.bouncycastle:bcpg-jdk12, Maven: org.bouncycastle:bcpg-jdk14, Maven: org.bouncycastle:bcpg-jdk15, Maven: org.bouncycastle:bcpg-jdk15to18, Maven: org.bouncycastle:bcpg-jdk15on, Maven: org.bouncycastle:bcpg-jdk16, Maven: org.bouncycastle:bcpg-jdk18on

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

openSUSE-SU-2026:10571-1 — bouncycastle-1.84-1.1 on GA media

bouncycastle-1.84-1.1 on GA media

RHSA-2026:17668 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corru…

SUSE-SU-2026:21404-1 — Security update for bouncycastle

Security update for bouncycastle

UBUNTU-CVE-2026-3505

Affected: Ubuntu:Pro:16.04:LTS: bouncycastle, Ubuntu:Pro:18.04:LTS: bouncycastle, Ubuntu:Pro:20.04:LTS: bouncycastle, Ubuntu:Pro:22.04:LTS: bouncycastle, Ubuntu:Pro:24.04:LTS: bouncycastle, Ubuntu:25.10: bouncycastle, Ubuntu:26.04:LTS: bouncycastle

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

WID-SEC-W-2026-1129 — Bouncy Castle BC-JAVA: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Bouncy Castle BC-JAVA ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.