B
Vendor security profile
bouncycastle
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs33
Critical4
CISA KEV0
Public exploit1
Patch rate%100
Avg. CVSS8.2
12-month vulnerability rate
0
0
0
0
0
0
0
0
1
32
0
0
CVE KEV
CVE severity distribution
33toplam CVE
Critical4 (12%)
High23 (70%)
Medium6 (18%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%3
Public exploit
33Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
5.3
CVE-2026-13586
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
LO
Patch verifiedEPSS %0
8.7
CVE-2026-13506
Lazy ASN.1 sequence forcing resets nesting-depth guard
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12860
RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12852
MLS wire decoder allocates attacker-declared opaque length before bounds check
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12817
OpenPGP AEAD decryption skips final tag on chunk-aligned data
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12816
IESEngine stream-mode MAC forgery via length-dependent KDF split
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12803
KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
LO
Patch verifiedEPSS %0
8.7
CVE-2026-12802
CMS AuthEnvelopedData fails to enforce tag-length on decryption
LO
Patch verifiedEPSS %0
8.7
CVE-2026-14682
Possible OOM from unbounded up-front allocation on a definite-length read
LO
Patch verifiedEPSS %0
8.7
CVE-2026-58059
Quadratic-time escaping when stringifying X.500 distinguished names
LO
Patch verifiedEPSS %0