CVE-2016-1000345: Vulnerability in org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Summary
CVE-2016-1000345: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. Affects org.bouncycastle:bcprov-jdk14 versions < 1.56. Fixed in 1.56. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2016-1000345 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 packages are part of the Bouncy Castle Java Cryptography API. They provide a wide range of cryptographic algorithms and utilities for secure communication and data protection. These packages are commonly used in Java applications for encryption, decryption, and other cryptographic operations.
Vulnerability Detail
The Bouncy Castle JCE Provider versions 1.55 and earlier are vulnerable to a padding oracle attack in the DHIES/ECIES CBC mode. This vulnerability allows an attacker to exploit the padding scheme used in the encryption process to decrypt ciphertexts without knowing the encryption key. By observing the timing of decryption failures, an attacker can deduce information about the plaintext and potentially recover sensitive data. This vulnerability has a CVSS score of 5.9, indicating a moderate severity.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.56
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of the packages to mitigate the risk of exploitation.
Conclusion
The org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 packages are vulnerable to a padding oracle attack in the DHIES/ECIES CBC mode. To protect your application and data, it is crucial to upgrade to version 1.56 or later of these packages. This will ensure secure encryption and decryption operations and mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
This vulnerability allows an attacker to decrypt ciphertexts without knowing the encryption key, potentially exposing sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to patch your application to prevent potential exploitation.
No, upgrading to the fixed versions of the packages is the only recommended solution to mitigate the risk of exploitation.
You can refer to the GitHub Advisory Database for more details on this vulnerability: [link to the advisory]
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
