BC
Product
BC-FJA
32
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Severity mix
Critical 2High 20Medium 10Low 0
Watch
Add BC-FJA to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-71892 | 6.9 | Oct 3 | CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys Affected: 2.0.7 before 2.0.13; 2.1.0 before 2.1.13 |
| CVE-2026-59638 | 6.5 | Aug 3 | JSSE hostname verifier CN-fallback enabled by default despite documented opt-in Affected: 1.0.7 before 1.0.24; 2.0.0 before 2.0.24; 2.1.0 before 2.1.24 |
| CVE-2025-8885 | 6.3 | Aug 12 | Possible DOS in processing specially formed ASN.1 Object Identifiers Affected: 1.0.0 through 1.0.2.5; 2.0.0 through 2.0.1 |
| CVE-2026-17508 | 5.3 | Oct 2 | Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points Affected: 1.0.0 before 1.0.13; 2.0.0 before 2.0.13; 2.1.0 before 2.1.13 |
| CVE-2026-58063 | 5.3 | Aug 3 | BCFKS keystore load honours unbounded KDF cost from untrusted file Affected: 1.0.0 before 1.0.2.7; 2.0.0 before 2.0.2; 2.1.0 before 2.1.3 |
| CVE-2026-59640 | 5.3 | Aug 3 | OpenPGP CFB quick-check oracle active on symmetric/session-key paths Affected: 1.0.0 before 1.0.13; 2.0.0 before 2.0.13; 2.1.0 before 2.1.13 |
| CVE-2026-59641 | 5.3 | Aug 3 | S/MIME validator trusts signer-asserted signingTime for path validation Affected: 1.0.0 before 1.0.7; 2.0.0 before 2.0.7; 2.1.0 before 2.1.7; 1.0.4 before 1.0.7; 2.0.0 before 2.0.7; 2.1.0 before 2.1.7 |
| CVE-2026-59647 | 5.3 | Aug 3 | CRMF/CMP password-MAC honours unbounded iteration count Affected: 1.0.0 before 1.0.12; 2.0.0 before 2.0.12; 2.1.0 before 2.1.12 |
| CVE-2026-59648 | 5.3 | Aug 3 | OpenPGP Argon2 S2K honours attacker-chosen memory and passes Affected: 1.0.6 before 1.0.13; 2.0.0 before 2.0.13; 2.1.0 before 2.1.13 |
| CVE-2026-8149 | 5.1 | May 8 | GCM chunking can lead to bad tag exception on decryption Affected: 2.1.0 before 2.1.3 |
Showing 10