CVE-2016-1000342: Bouncy Castle JCE Provider ECDSA ASN.1 Encoding Validation Vulnerability
Summary
CVE-2016-1000342: In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification. Affects org.bouncycastle:bcprov-jdk14 versions < 1.56. Fixed in 1.56. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2016-1000342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bouncy Castle JCE Provider is a Java Cryptography Extension (JCE) library that provides a wide range of cryptographic algorithms and utilities. It is commonly used in Java applications for secure communication and data encryption. The affected package, org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15, are specific versions of the Bouncy Castle JCE Provider designed for JDK 1.4 and JDK 1.5 respectively. These versions are vulnerable to an ECDSA ASN.1 encoding validation issue.
Vulnerability Detail
The vulnerability in the Bouncy Castle JCE Provider version 1.55 and earlier lies in the ECDSA signature verification process. The library fails to fully validate the ASN.1 encoding of the signature during verification. This allows an attacker to inject extra elements into the signature sequence, which can result in the introduction of 'invisible' data into a signed structure. This vulnerability has a CVSS score of 7.5, indicating a high severity level. Exploiting this vulnerability could lead to the compromise of signed data and the integrity of cryptographic operations.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.56
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Bouncy Castle JCE Provider library to mitigate the risk.
Conclusion
The Bouncy Castle JCE Provider ECDSA ASN.1 encoding validation vulnerability (CVE-2016-1000342) poses a significant risk to the integrity of signed data and cryptographic operations. It is crucial to upgrade to the fixed version (1.56 or later) of the Bouncy Castle JCE Provider library to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
This vulnerability allows an attacker to inject extra elements into the ECDSA signature, potentially compromising the integrity of signed data and cryptographic operations.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to apply the fix to prevent any potential exploitation.
No, only versions 1.55 and earlier are affected by this vulnerability. It is recommended to upgrade to version 1.56 or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
