# CVE-2026-0636: Bouncy Castle has an LDAP injection > CVE-2026-0636 (GitHub advisory GHSA-c3fc-8qff-9hwx) is a medium-severity vulnerability with a CVSS 4.0 base score of 5.5, classed as Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') (CWE-90), in org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15to18 (Maven) and org.bouncycastle:bcprov-jdk18on (Maven). It is fixed in 1.84. Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-0636 | Field | Value | | --- | --- | | CVE | CVE-2026-0636 | | GHSA | GHSA-c3fc-8qff-9hwx | | Severity | Medium | | CVSS 4.0 | 5.5 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber` (GitHub Advisory Database) | | CVSS 4.0 | 5.5 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber` (CVE.org) | | CVSS 3.1 | 6.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N` (CVE.org) | | CWE | CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | | EPSS | 0.52% (higher than 42% of CVEs) | | CISA KEV | Not listed | | SSVC | exploitation none, automatable yes, technical impact partial | | Published | 15 Apr 2026 | | Modified | 18 Sept 2026 | ## Description Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.84. ## Affected packages | Package | Ecosystem | PURL | Vulnerable versions | Fixed in | | --- | --- | --- | --- | --- | | org.bouncycastle:bcprov-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk14` | >= 1.74, < 1.84 | 1.84 | | org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | >= 1.74, < 1.84 | 1.84 | | org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | >= 1.74, < 1.84 | 1.84 | ## Fix commits - Patch: https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde - Release: https://github.com/bcgit/bc-java/commit/d3fbd45fd5e27fbc3a69b8ab150619f0dc8a6a44 (1.80.2) - Release: https://github.com/bcgit/bc-java/commit/dd0e7f83eef6b5d157139c9da21852d44bfcef71 (1.81.1) - Release: https://github.com/bcgit/bc-java/commit/d716d7716a452bad283323aefd88ff21eba8deef (1.84) ## Questions **What is the GHSA ID for CVE-2026-0636?** GitHub tracks CVE-2026-0636 as GHSA-c3fc-8qff-9hwx. **What is the CVSS score of CVE-2026-0636?** CVE-2026-0636 has a CVSS 4.0 base score of 5.5 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber. Other published scores: CVSS 3.1 6.5. **Which versions are affected by CVE-2026-0636?** org.bouncycastle:bcprov-jdk14 (Maven): >= 1.74, < 1.84. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.74, < 1.84. org.bouncycastle:bcprov-jdk18on (Maven): >= 1.74, < 1.84. **How do I fix CVE-2026-0636?** Upgrade to 1.84 or later. The fix is in commit d20cdb8. **What is the Package URL (PURL) for CVE-2026-0636?** The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk15to18 and pkg:maven/org.bouncycastle/bcprov-jdk18on. **Is CVE-2026-0636 exploited in the wild?** CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-0636. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42% of CVEs. ## References - https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde (fix) - https://nvd.nist.gov/vuln/detail/CVE-2026-0636 (advisory) - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636 (advisory) - https://access.redhat.com/errata/RHSA-2026:11720 (advisory) - https://access.redhat.com/errata/RHSA-2026:11721 (advisory) - https://access.redhat.com/errata/RHSA-2026:13631 (advisory) - https://access.redhat.com/errata/RHSA-2026:14272 (advisory) - https://access.redhat.com/errata/RHSA-2026:14276 (advisory) - https://access.redhat.com/errata/RHSA-2026:17668 (advisory) - https://access.redhat.com/errata/RHSA-2026:18054 (advisory) - https://access.redhat.com/errata/RHSA-2026:18055 (advisory) - https://access.redhat.com/errata/RHSA-2026:18059 (advisory) - https://access.redhat.com/errata/RHSA-2026:21772 (advisory) - https://access.redhat.com/errata/RHSA-2026:53644 (advisory) - https://access.redhat.com/errata/RHSA-2026:53645 (advisory) - https://access.redhat.com/errata/RHSA-2026:53646 (advisory) - https://access.redhat.com/errata/RHSA-2026:60239 (advisory) - https://access.redhat.com/errata/RHSA-2026:60246 (advisory) - https://access.redhat.com/errata/RHSA-2026:60247 (advisory) - https://access.redhat.com/errata/RHSA-2026:60248 (advisory) - https://access.redhat.com/errata/RHSA-2026:60249 (advisory) - https://access.redhat.com/errata/RHSA-2026:60250 (advisory) - https://access.redhat.com/errata/RHSA-2026:60251 (advisory) - https://access.redhat.com/errata/RHSA-2026:60252 (advisory) - https://access.redhat.com/errata/RHSA-2026:60254 (advisory) - https://access.redhat.com/errata/RHSA-2026:60256 (advisory) - https://access.redhat.com/errata/RHSA-2026:60259 (advisory) - https://access.redhat.com/errata/RHSA-2026:66488 (advisory) - https://access.redhat.com/security/cve/CVE-2026-0636 (advisory) - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0636.json (advisory) - https://github.com/advisories/GHSA-c3fc-8qff-9hwx (advisory) - https://bugzilla.redhat.com/show_bug.cgi?id=2458641 (report) - https://github.com/bcgit/bc-java (package) - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json - https://www.bouncycastle.org/download/bouncy-castle-java/ --- Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-0636), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.