CVE-2016-1000344: Bouncy Castle JCE Provider DHIES ECB Mode Vulnerability
Summary
CVE-2016-1000344: In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode. Affects org.bouncycastle:bcprov-jdk14 versions < 1.56. Fixed in 1.56. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2016-1000344 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bouncy Castle JCE Provider is a Java Cryptography Extension (JCE) provider that offers a wide range of cryptographic algorithms and utilities. It is commonly used in Java applications for secure communication and data encryption. The DHIES (Diffie-Hellman Integrated Encryption Scheme) is one of the encryption schemes provided by Bouncy Castle. However, versions 1.55 and earlier of the provider allowed the use of ECB (Electronic Codebook) mode, which is considered unsafe due to its vulnerability to certain cryptographic attacks.
Vulnerability Detail
The vulnerability (CVE-2016-1000344) in the Bouncy Castle JCE Provider arises from the use of ECB mode in the DHIES implementation. ECB mode does not provide proper confidentiality and is susceptible to various attacks, such as pattern recognition and chosen plaintext attacks. This could potentially lead to the exposure of sensitive information and compromise the security of the encrypted data. The vulnerability has been addressed in version 1.56 of the provider, which removes support for ECB mode.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.56
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of the Bouncy Castle JCE Provider.
Conclusion
The Bouncy Castle JCE Provider version 1.55 and earlier are vulnerable to a DHIES ECB mode vulnerability. Upgrading to version 1.56 or later is recommended to address this issue. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
The Bouncy Castle JCE Provider is a Java library that provides cryptographic algorithms and utilities for secure communication and data encryption.
DHIES (Diffie-Hellman Integrated Encryption Scheme) is an encryption scheme provided by the Bouncy Castle JCE Provider for secure communication.
ECB (Electronic Codebook) mode is considered unsafe because it does not provide proper confidentiality and is vulnerable to certain cryptographic attacks.
The vulnerability could lead to the exposure of sensitive information and compromise the security of encrypted data.
To fix this vulnerability, you need to upgrade to version 1.56 or later of the Bouncy Castle JCE Provider by updating the Maven dependency in your project's configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
