Improper neutralization of special elements in LDAP queries, known as LDAP injection, is present in Legion of the Bouncy Castle Inc. BC-JAVA bcprov library across all prov modules. The flaw in LDAPStoreHelper.java allows an attacker to embed arbitrary LDAP filter syntax through unsanitized input, potentially enabling unauthorized reading or modification of directory entries and undermining authentication mechanisms. This weakness is identified as CWE‑90.

Legion of the Bouncy Castle Inc. provides the BC-JAVA bcprov component in its prov modules. Versions from 1.74 up to, but not including, 1.80.2; from 1.81 up to, but not including, 1.81.1; and from 1.82 up to, but not including, 1.84 are affected. The issue applies to all bcprov modules that use LDAPStoreHelper.java.

The vulnerability carries a CVSS score of 5.5, indicating moderate impact. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the fact that the flaw involves unsanitized input that can be supplied by an external source to the LDAP query construction within any application that incorporates the affected Bouncy Castle library. This makes it a moderate-risk, attack‑vector‑indirect risk.