Description
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
Published: 2026-08-03
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LDAP filter injection is present in the legacy jdk1.4 LDAPStoreHelper component of Bouncy Castle for Java versions prior to 1.85. The flaw permits an attacker to inject arbitrary LDAP filter strings into directory queries. Based on the description, it is inferred that this could allow manipulation of LDAP queries and potentially access to directory data beyond the intended scope.

Affected Systems

Bouncy Castle Inc. provides the affected product BC-JAVA. All releases before version 1.85 contain the vulnerable LDAPStoreHelper. This component can be used by any Java application that relies on Bouncy Castle for LDAP directory interactions.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack path requires an attacker to supply input that is directly incorporated into an LDAP filter, so the vulnerability can be exploited from any code path that forwards untrusted data to the LDAP store helper. Once exploited, the attacker could modify LDAP queries as described, though specific exploitation outcomes are not documented in the CVE.

Generated by OpenCVE AI on August 4, 2026 at 10:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Bouncy Castle Java 1.85 or newer, where the LDAP filter injection issue has been remediated.
  • If an upgrade is not feasible at this time, ensure that any data incorporated into LDAP filters is properly escaped or scrubbed, and that the legacy jdk1.4 LDAPStoreHelper is used only with strictly validated input.
  • Where possible, disable or replace the legacy jdk1.4 LDAPStoreHelper in your application to eliminate the insecure code path.

Generated by OpenCVE AI on August 4, 2026 at 10:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

threat_severity

Moderate

Mon, 03 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Legion Of The Bouncy Castle Inc.
Legion Of The Bouncy Castle Inc. bc-java
Vendors & Products Legion Of The Bouncy Castle Inc.
Legion Of The Bouncy Castle Inc. bc-java

Mon, 03 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
References

Mon, 03 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Description In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
Title LDAP filter injection in legacy jdk1.4 LDAPStoreHelper
Weaknesses CWE-90
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber'}

Subscriptions

Legion Of The Bouncy Castle Inc. Bc-java
cve-icon MITRE

Status: PUBLISHED

Assigner: bcorg

Published:

Updated: 2026-08-03T13:30:51.667Z

Reserved: 2026-07-06T07:09:01.524Z

Link: CVE-2026-59652

cve-icon Vulnrichment

Updated: 2026-08-03T13:30:48.013Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-08-03T01:16:45.513

Modified: 2026-08-04T14:50:12.360

Link: CVE-2026-59652

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-03T00:39:23Z

Links: CVE-2026-59652 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T11:00:07Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')