CVE-2026-0636 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-0636 PUBLISHED CVSS 5.5 MEDIUM

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.84.

Risk Scores

CVSS v4.0

5.5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber

Affected Products

Vendor	Product	Versions
Legion of the Bouncy Castle Inc.	BC-JAVA	1.74

Timeline

Apr 15, 2026 CVE Published
Apr 15, 2026 PoC Published
Apr 17, 2026 CVE Updated
Apr 18, 2026 Security Advisory
May 6, 2026 Distribution Patch
May 6, 2026 Security Advisory
May 6, 2026 Distribution Patch
May 6, 2026 Security Advisory
May 6, 2026 Distribution Patch
May 6, 2026 Security Advisory
May 6, 2026 Distribution Patch
May 6, 2026 Security Advisory

References

Open in Interactive Console →