CVE-2026-0636
MEDIUMLDAP Injection Vulnerability in LDAPStoreHelper.java
Title source: cnaDescription
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.84.
Scores
CVSS v4
5.5
EPSS
0.0006
EPSS Percentile
19.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber
Details
CWE
CWE-90
Status
published
Products (4)
Legion of the Bouncy Castle Inc./BC-JAVA
1.74 - 1.84
org.bouncycastle/bcprov-jdk14
1.74 - 1.84Maven
org.bouncycastle/bcprov-jdk15to18
1.74 - 1.84Maven
org.bouncycastle/bcprov-jdk18on
1.74 - 1.84Maven
Published
Apr 15, 2026
Tracked Since
Apr 15, 2026