CVE-2026-0636: Bouncy Castle LDAP Injection Vulnerability
Summary
CVE-2026-0636: Bouncy Castle has an LDAP injection. Affects org.bouncycastle:bcprov-jdk14 versions >= 1.74, < 1.84. Fixed in 1.84. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bouncy Castle is a widely used cryptography library that provides APIs for various cryptographic operations. It is utilized in many Java applications for secure data transmission and encryption. The library is known for its extensive support for different cryptographic algorithms and protocols. However, a recent vulnerability has been identified that affects its LDAP query handling, potentially allowing attackers to manipulate LDAP queries and gain unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability, identified as LDAP injection, arises from improper neutralization of special elements used in LDAP queries within the Bouncy Castle library. This flaw can be exploited by attackers to inject malicious LDAP statements, leading to unauthorized access or manipulation of data. The issue is present in versions of the library from 1.74 up to, but not including, 1.84. If exploited, this vulnerability can compromise the security of applications relying on Bouncy Castle for LDAP operations.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.84
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization for any user inputs that are used in LDAP queries to mitigate the risk of injection attacks. This can help reduce the likelihood of exploitation until the library can be updated.
Conclusion
The LDAP injection vulnerability in Bouncy Castle poses a significant risk to applications that utilize this library for LDAP operations. It is crucial for developers to update to the patched version 1.84 or later to mitigate this risk. Additionally, employing input validation can serve as a temporary measure until the upgrade can be performed.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
LDAP injection is a type of attack that allows an attacker to manipulate LDAP queries by injecting malicious input, potentially leading to unauthorized access or data manipulation.
The vulnerability affects Bouncy Castle versions from 1.74 up to, but not including, 1.84.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your application's pom.xml file on the Vulert playground, you can determine if it is affected by this vulnerability.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
If you cannot upgrade the library right away, implement input validation and sanitization for user inputs used in LDAP queries to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
