Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

BC-JAVA — Vulnerabilities & Security Advisories 52

All 52 CVE vulnerabilities found in BC-JAVA, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) associated with the SAP Business Suite Java stack, known as BC-JAVA. It serves as a centralized repository for tracking security flaws within this specific enterprise component, allowing users to identify and analyze risks related to the underlying Java infrastructure used by SAP applications. The collection covers a wide spectrum of vulnerability types, including remote code execution, cross-site scripting, SQL injection, and improper access control mechanisms. The data spans from the early 2000s to the present day, ensuring historical context and current relevance. This extensive time range allows administrators to review long-term security trends and assess how patching strategies have evolved over time. By exploring this page, you can track vendor advisories issued by SAP to address these specific weaknesses, gaining insight into their remediation timelines and priority levels. Additionally, the resource helps users understand the technical nuances of each weakness class as it applies to the BC-JAVA environment, facilitating better risk assessment. Finally, the page enables you to look up a product’s vulnerability history, providing a clear timeline of disclosed issues and resolved patches. This information supports informed decision-making for system hardening, compliance reporting, and proactive security management within SAP landscapes.

Vendor: Legion of the Bouncy Castle Inc.

CVE ID Title CVSS Severity Published
CVE-2026-59640 OpenPGP CFB quick-check oracle active on symmetric/session-key paths CWE-203 8.7 High 2026-08-03
CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation CWE-345 8.7 High 2026-08-03
CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present CWE-354 8.7 High 2026-08-03
CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored CWE-347 8.7 High 2026-08-03
CVE-2026-59644 MLS hash-ratchet honours arbitrary 32-bit generation counter from sender CWE-834 8.7 High 2026-08-03
CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema CWE-674 8.7 High 2026-08-03
CVE-2026-59646 DTLS handshake reassembler allocates buffer from unchecked 24-bit length CWE-789 8.7 High 2026-08-03
CVE-2026-59647 CRMF/CMP password-MAC honours unbounded iteration count CWE-770 6.9 Medium 2026-08-03
CVE-2026-59648 OpenPGP Argon2 S2K honours attacker-chosen memory and passes CWE-770 6.9 Medium 2026-08-03
CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory CWE-789 8.7 High 2026-08-03
CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value CWE-20 9.3 Critical 2026-08-03
CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key CWE-326 7.1 High 2026-08-03
CVE-2026-59652 LDAP filter injection in legacy jdk1.4 LDAPStoreHelper CWE-90 6.9 Medium 2026-08-03
CVE-2026-12185 BKS/UBER keystore allocates from untrusted lengths before integrity check CWE-789 7.1 High 2026-08-03
CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI CWE-295 9.3 Critical 2026-08-03
CVE-2026-15055 PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input CWE-770 5.3 Medium 2026-08-03
CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) CWE-208 8.2 High 2026-07-28
CVE-2026-3505 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. CWE-770 8.7 High 2026-04-15
CVE-2026-5588 PKIX draft CompositeVerifier accepts empty signature sequence as valid. CWE-327 6.3 Medium 2026-04-15
CVE-2026-5598 Non-constant time comparisons risk private key leakage in FrodoKEM. CWE-385 8.9 High 2026-04-15
CVE-2026-0636 LDAP Injection Vulnerability in LDAPStoreHelper.java CWE-90 5.5 Medium 2026-04-15
CVE-2025-14813 GOSTCTR implementation unable to process more than 255 blocks correctly CWE-327 9.3 Critical 2026-04-15

All 52 known CVE vulnerabilities affecting BC-JAVA with full Chinese analysis, references, and POCs where available.