CVE-2026-0636
- Source
- https://cve.org/CVERecord?id=CVE-2026-0636
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0636.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-0636
- Aliases
- Downstream
- Related
- Published
- 2026-04-15T08:59:12.677Z
- Modified
- 2026-07-22T04:18:30.567871Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber CVSS Calculator
- Summary
- LDAP Injection Vulnerability in LDAPStoreHelper.java
- Details
-
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0636.json", "cna_assigner": "bcorg", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "1.74" }, { "fixed": "1.80.2" }, { "introduced": "1.81" }, { "fixed": "1.81.1" } ] } ], "cwe_ids": [ "CWE-90" ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json
- https://www.bouncycastle.org/download/bouncy-castle-java/
- https://access.redhat.com/errata/RHSA-2026:11720
- https://access.redhat.com/errata/RHSA-2026:11721
- https://access.redhat.com/errata/RHSA-2026:13631
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:14276
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/security/cve/CVE-2026-0636
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0636.json
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636
- https://nvd.nist.gov/vuln/detail/CVE-2026-0636
- https://bugzilla.redhat.com/show_bug.cgi?id=2458641
- https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde
- https://github.com/bcgit/bc-java
Affected packages
Git / github.com/bcgit/bc-java
Database specific
vanir_signatures
[
{
"digest": {
"length": 1307.0,
"function_hash": "218723445102947189163755099320644798634"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "engineGetCRLs",
"file": "prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java"
},
"id": "CVE-2026-0636-0549a512",
"deprecated": false
},
{
"digest": {
"length": 774.0,
"function_hash": "154905553150270499879117828794999297763"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "crossCertificatePairSubjectSearch",
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-1226abfb",
"deprecated": false
},
{
"digest": {
"length": 977.0,
"function_hash": "157525422951556934850078845756111310286"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "certSubjectSerialSearch",
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-1fcc729d",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"258378562642072359389179262542422477636",
"253925791961670226487360474226596313745",
"277414600293024535008995524334597765474",
"308923253851942580592752691213106583747",
"287910128580926576064976026737446518991",
"85493362580846715566371438053000123350",
"139909640650144881872582294670287630736",
"250137195572577419009751380342288142600",
"26679519518675302668529182040033098720",
"244418334542561201639139968792945018137",
"179843259285544205042183692158265100847",
"313523817192299562593591698391852246406",
"82337512241961669582890950665445286869",
"72401296945361946702035817256281754048",
"46190794357034759078181582957936458428",
"265208431368522262915253274525372724730",
"44809862253230952053228827344866045804",
"23815537929988868997663557799069449501",
"259419729012150669715338921057001074568",
"34557831615285427365477171172280936544",
"119061595616159138149811929366427670238",
"147177685041521383848470055793308685133",
"637694583026989183133312900073694657",
"101606759536992231805379777693906449209",
"280516484901979393049929942884388607444",
"178292733246351648193232499415305309225",
"65729424353671796327907383563897270812",
"48603673104563824138898961288833393144",
"77735248702120412553758496074807152360",
"151607787983777979000522460078970253794",
"135588077515691954290181907112099107506",
"235404644616290163341958893842799790654",
"178292733246351648193232499415305309225",
"74620557851045019501219564156364387468",
"162439706818779805779068013120526874446",
"281821593532415954881270435786656738221",
"149999246695764734436049723649658067809",
"150151242774099264094821145375045486472",
"106404190860142806225531035899404725858",
"180093929148621733298752727670781546883",
"83802119205760347573979387712561180712",
"263933538654597252841785194275096931312",
"275929673586356423271908696184450798832",
"140240946840661236995212323127712037023",
"332932717817228584925247373481153692903",
"260728429821243915334080894725170123992",
"2079128601049474062002379092515264092",
"6742414479341825653438950140576220495",
"46183498481318177149939144590458261277",
"93666973652124033515484725573589949531",
"238095040100688662427092212000131065590",
"180157609784480486688735568789110998769",
"50482616471516041794130480247006218112",
"287679928855296849558554203373439388860",
"254840265356152502399097258663021563940",
"135955581746484302990385074464772559270",
"263978648434963668541722688159800919071",
"66102738917081149669907077489709466670",
"108171394474774300810658496032619631433",
"94624916981050634792021933273255062060",
"166399380965299549393798790842820168919",
"260448441459339555258789500585300389389",
"274956403464021580912446697978452547210",
"120749219542991074333618037737466479784",
"108040362374720683629746078286022021772",
"254840265356152502399097258663021563940",
"135955581746484302990385074464772559270",
"263978648434963668541722688159800919071",
"66102738917081149669907077489709466670",
"254840265356152502399097258663021563940",
"135955581746484302990385074464772559270",
"263978648434963668541722688159800919071",
"66102738917081149669907077489709466670",
"235945755413889284729147131966108147740",
"330048153290374878557514945817214113132",
"197390882422548906365364714778158955040",
"223426195896531345215413880696090004309",
"274687861815928601465943002952855175497",
"15708557860823971143846486208657498401",
"110598259527452532568228541977537563436",
"155657437076291583127435730968994875511",
"95664523741899966093108211342700706407",
"165536623993898184559377967813692409878",
"5503401700032096978184097776586615160",
"292467666564888939920170141798422521475",
"7522835466641601779162904589548607873",
"93680085126590617275907948386412261881",
"9917690863961288613504317625993530347",
"147823511955110499146813472339403142337",
"40703063977308280198813114986590353552",
"90800659274145016276595444504451256048",
"25238468251716317885334674092540314277",
"182928047598594484558102000945637658100",
"11485440158555542018239532571118742512",
"65621799817497142416043050693317815175",
"150188365244212195338034334971233641198",
"43389154925502998472432958541762570455",
"10192642752996337626210898226718522366",
"87016653069658626577902749286025512361",
"103501180399456928738449537542917946547",
"95841034663414067451014738649564156344",
"90467260159723838279354146901844979031",
"181421003851018086895005326308284649335",
"39394894723176734422039723635927033372",
"162243553374311193535947312563606772500",
"333902035449713694447675168670624312367",
"273501212896204929897470976870569942251",
"12814681396276106708517859073937928302",
"94918602123213174920245082206264970507",
"263785047445300257565654707747320840474",
"179108180931053461199732630682473880145",
"154353269648080454811821860290239815014",
"336528200810818296150078692491285403349",
"225732191308818235494555316191399514437",
"220805612411658583081365869475028949527",
"97168761956949828037616782012999085171",
"8761793863926633767082818516164234334",
"75650311776722442453717748528292656812",
"237248172930532380916480208352866913320",
"172661692565120274888495435451817898807",
"139310423104248879870877226651231459357",
"75394001419764602362413082175470301894",
"175248466758776192478165206348253833232",
"108552641609683702893209536704395777225",
"104983249714827316373869003976057892647",
"314976351216623199365727638256539758096",
"168255624011620077605428355850193947708",
"232649044037945486609708421306323767604",
"148388688469356911727225120803639864153",
"204893132542368093920460277591026333238",
"273190308815538522857680920605534994658",
"130480243538035927251766973451753065645",
"87598462892592632398659865934602225549",
"13149731133111474301511502801900366305",
"63171792741537159357190936755078825631",
"91544874309912811340945227201510739314",
"100576082761296994242641970194941648722",
"307812287294293781137249514812408897026",
"332665511993124298188115674961043684250"
]
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Line",
"target": {
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-5aaf8312",
"deprecated": false
},
{
"digest": {
"length": 1630.0,
"function_hash": "282603396091181613354454126847553278819"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "attrCertSubjectSerialSearch",
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-5f3f6381",
"deprecated": false
},
{
"digest": {
"length": 1037.0,
"function_hash": "231951137429685275706451917304804475585"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "certSubjectSerialSearch",
"file": "prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java"
},
"id": "CVE-2026-0636-70102dd6",
"deprecated": false
},
{
"digest": {
"length": 1065.0,
"function_hash": "240343912367144974804379295360148979958"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "cRLIssuerSearch",
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-7ccdb998",
"deprecated": false
},
{
"digest": {
"length": 780.0,
"function_hash": "328958545825899232843514982476084091947"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "parseDN",
"file": "prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java"
},
"id": "CVE-2026-0636-8ee7e724",
"deprecated": false
},
{
"digest": {
"length": 807.0,
"function_hash": "287906564550893832940728576066541568414"
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Function",
"target": {
"function": "parseDN",
"file": "prov/src/main/java/org/bouncycastle/x509/util/LDAPStoreHelper.java"
},
"id": "CVE-2026-0636-cd49149a",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"140700354397980741990467913929878752303",
"1612127630195009021125285116331606532",
"318507328836519496877704672899321024125",
"242525605592733260014818605458214815576",
"213350235583821731664455188573441222608",
"211957728315813795822153923794294094038",
"179128399976270115652001696269500269697",
"306710343994990320138779766448064484266",
"255537464704078293954496145506875214885",
"215812362371778283440111904234880138318",
"3891941539796577661984503115263045961",
"225549754155164072947481512473054370448",
"175431944376420636581924958763705853617",
"89867450245653659042578651302373678331",
"86727898840065385243351577002760265413",
"149403075409036851121776603226567633640",
"107409770441265103631426307801919253416",
"60579906381301567047470127529795518145",
"149995379607558872446176128673344496781",
"223380246560954080373934159427507174730",
"118205913898451702666133943823760391666",
"49213653055426641129307381412258674855",
"241548392400553386968546635160060720801",
"81561542976135874844286413534031577081",
"118687367605126845253124019791338771103",
"47637654156043742440939928358530573759",
"122075338904953856448188666961073046264",
"11494035426941516481946864719060427302",
"280516484901979393049929942884388607444",
"178292733246351648193232499415305309225",
"65729424353671796327907383563897270812",
"48603673104563824138898961288833393144",
"77735248702120412553758496074807152360",
"151607787983777979000522460078970253794",
"135588077515691954290181907112099107506",
"235404644616290163341958893842799790654",
"178292733246351648193232499415305309225",
"74620557851045019501219564156364387468",
"162439706818779805779068013120526874446",
"281821593532415954881270435786656738221",
"149999246695764734436049723649658067809",
"150151242774099264094821145375045486472",
"106404190860142806225531035899404725858",
"180093929148621733298752727670781546883",
"83802119205760347573979387712561180712",
"263933538654597252841785194275096931312",
"275929673586356423271908696184450798832",
"140240946840661236995212323127712037023",
"332932717817228584925247373481153692903",
"260728429821243915334080894725170123992",
"2079128601049474062002379092515264092",
"6742414479341825653438950140576220495",
"46183498481318177149939144590458261277",
"154146260934793401995068950740225984004",
"303859202282496230655979632447226352784",
"193840681111734537121281547508864726275",
"148819272530718103290522894883593519103",
"330927074674430673318192410644952875075",
"336730823052647833095084566776064737085",
"210036790818964584491346644020967408226",
"117829560286724322019124730511484190227",
"312758990600387830603186451475377065577",
"271693268719818147658482021589923810184",
"204108479801848178789122556705739653129",
"47568742121372046516726189921289128982",
"139639058635469815110533627311019390093",
"94932447284687682849025174315818758713",
"3267644348036471319171852964595236039",
"167469554439145597974176932292692973693",
"150506175785078078305229047606099944068",
"112730809481918643160671940875292459315",
"255492833264768995150309875648198424472",
"252348860025144139897150457849853551661",
"35767915308480197805895811382768835935",
"275147021038723865617088347072405179457",
"85179252525425448624518903547646858341",
"226176352644159070210515127057551891582",
"136214442384443765952533302950166919408",
"181398954048761040204423311348062609827",
"161248920784072897796353224063600439148",
"79882033241534280329460234310938646509",
"57794336173161221472665594560533585989",
"167415136185343086869834598826346383982",
"291019684991874201358992720856551819244",
"77227264132069647768437029686833071442",
"33700804854773383598260040709761761660",
"104495900683921626408135822441954968886",
"24655861450864900557142641765959004120",
"246244528557961403605376405246415073494",
"249714421856477279019094858846995169109",
"232079457546880800704135374549741999925",
"333297056434739917775723112451634857809",
"107852952486498791841709218709151962612",
"204559312804357177074177388765216757830",
"89859407071307737502900567884083481423",
"193890587833630063931921360770512088384",
"30178755015952811169852274464711631705"
]
},
"signature_version": "v1",
"source": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"signature_type": "Line",
"target": {
"file": "prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java"
},
"id": "CVE-2026-0636-dd9aa079",
"deprecated": false
}
]
vanir_signatures_modified
"2026-07-22T04:18:30Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0636.json"