Org.bouncycastle:bc-fips

This hub aggregates every CVE we track for Org.bouncycastle:bc-fips, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting Org.bouncycastle:bc-fips.

• CVE-2025-12194Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java...Oct 24, 2025
• CVE-2025-9340native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.Aug 22, 2025
• CVE-2025-9341Garbage collection can delay for AES CBC Native support, resulting in heap exhaustionAug 22, 2025
• CVE-2025-9092Hybrid Module Deployment in Multi-JVM Environments Leading to Resource ExhaustionAug 16, 2025
• CVE-2025-8885Possible DOS in processing specially formed ASN.1 Object IdentifiersAug 12, 2025
• CVE-2024-29857An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC ce...7.5May 9, 2024
• CVE-2022-45146An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it i...5.5Nov 21, 2022
• CVE-2020-15522Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information abou...5.9May 20, 2021
• CVE-2020-26939In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error I...5.3Nov 2, 2020