Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

BC-JAVA — Vulnerabilities & Security Advisories 52

All 52 CVE vulnerabilities found in BC-JAVA, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) associated with the SAP Business Suite Java stack, known as BC-JAVA. It serves as a centralized repository for tracking security flaws within this specific enterprise component, allowing users to identify and analyze risks related to the underlying Java infrastructure used by SAP applications. The collection covers a wide spectrum of vulnerability types, including remote code execution, cross-site scripting, SQL injection, and improper access control mechanisms. The data spans from the early 2000s to the present day, ensuring historical context and current relevance. This extensive time range allows administrators to review long-term security trends and assess how patching strategies have evolved over time. By exploring this page, you can track vendor advisories issued by SAP to address these specific weaknesses, gaining insight into their remediation timelines and priority levels. Additionally, the resource helps users understand the technical nuances of each weakness class as it applies to the BC-JAVA environment, facilitating better risk assessment. Finally, the page enables you to look up a product’s vulnerability history, providing a clear timeline of disclosed issues and resolved patches. This information supports informed decision-making for system hardening, compliance reporting, and proactive security management within SAP landscapes.

Vendor: Legion of the Bouncy Castle Inc.

CVE ID Title CVSS Severity Published
CVE-2026-71890 MLS external commit can remove an arbitrary group member CWE-863 8.7 High 2026-10-03
CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve CWE-347 7.1 High 2026-10-03
CVE-2026-18040 HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler CWE-208 5.9 Medium 2026-10-03
CVE-2026-71885 MLS X.509 credential not bound to the LeafNode signature key CWE-295 9.2 Critical 2026-10-03
CVE-2026-71886 OpenPGP certification accepted from a subkey without certification authority CWE-863 8.2 High 2026-10-03
CVE-2026-71887 OpenPGP data signature accepted from a signing subkey without cross-certification CWE-347 8.2 High 2026-10-03
CVE-2026-71888 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent CWE-354 8.7 High 2026-10-03
CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate CWE-295 8.7 High 2026-10-03
CVE-2026-71892 CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys CWE-697 6.9 Medium 2026-10-03
CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check CWE-354 8.2 High 2026-10-03
CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider CWE-770 5.3 Medium 2026-10-03
CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division CWE-208 8.2 High 2026-10-02
CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points CWE-770 5.3 Medium 2026-10-02
CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender CWE-195 8.7 High 2026-10-02
CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) CWE-770 5.3 Medium 2026-08-03
CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard CWE-674 8.7 High 2026-08-03
CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path CWE-347 8.7 High 2026-08-03
CVE-2026-12852 MLS wire decoder allocates attacker-declared opaque length before bounds check CWE-789 8.7 High 2026-08-03
CVE-2026-12817 OpenPGP AEAD decryption skips final tag on chunk-aligned data CWE-354 8.7 High 2026-08-03
CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split CWE-354 8.7 High 2026-08-03
CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) CWE-354 8.7 High 2026-08-03
CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption CWE-354 8.7 High 2026-08-03
CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read CWE-789 8.7 High 2026-08-03
CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names CWE-407 8.7 High 2026-08-03
CVE-2026-58060 HSS public-key level count unbounded, enabling huge allocation on verify CWE-789 8.7 High 2026-08-03
CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check CWE-354 8.7 High 2026-08-03
CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate CWE-295 9.3 Critical 2026-08-03
CVE-2026-58063 BCFKS keystore load honours unbounded KDF cost from untrusted file CWE-770 5.3 Medium 2026-08-03
CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CWE-297 9.3 Critical 2026-08-03
CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers CWE-347 8.7 High 2026-08-03

All 52 known CVE vulnerabilities affecting BC-JAVA with full Chinese analysis, references, and POCs where available.