bcpkix-fips vulnerabilities

CVEs whose affected-version data names the bcpkix-fips package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-17508Medium· 5.3

today

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary…

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary…

▾ SunlitLegion of the Bouncy Castle Inc. · bcpkixvia NVD