Skip to content
Fencer Intel
medium 6.5

CVE-2026-0636 json

LDAP Injection Vulnerability in LDAPStoreHelper.java

published 6mo ago modified 5d ago also GHSA-c3fc-8qff-9hwx , EUVD-2026-22849

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).

This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Patch / fix

  • maven org.bouncycastle:bcprov-jdk14 1.80.2, 1.81.1, 1.84
  • maven org.bouncycastle:bcprov-jdk15to18 1.80.2, 1.81.1, 1.84
  • maven org.bouncycastle:bcprov-jdk18on 1.80.2, 1.81.1, 1.84
  • Legion of the Bouncy Castle Inc. BC-JAVA 1.80.2, 1.81.1, 1.84
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 debug-jdk15on
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap, 0:2.5.5-24.SP12_redhat_00016.1.el7eap, 0:2.5.5-30.SP12_redhat_00020.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:4.1.135-1.Final_redhat_00001.1.el7eap, 0:5.0.31-3.SP2_redhat_00001.1.el7eap, 0:7.4.25-2.GA_redhat_00001.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:1.5.26-2.Final_redhat_00001.1.el8eap, 0:1.10.0-46.Final_redhat_00044.1.el8eap, 0:2.2.40-1.SP3_redhat_00001.1.el8eap, 0:2.3.14-11.SP11_redhat_00001.1.el8eap, 0:2.5.5-24.SP12_redhat_00016.1.el8eap, 0:2.5.5-30.SP12_redhat_00020.1.el8eap, 0:2.16.0-22.redhat_00057.1.el8eap, 0:2.18.8-1.redhat_00003.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:5.0.31-3.SP2_redhat_00001.1.el8eap, 0:7.4.25-2.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:1.5.26-2.Final_redhat_00001.1.el9eap, 0:1.10.0-46.Final_redhat_00044.1.el9eap, 0:2.2.40-1.SP3_redhat_00001.1.el9eap, 0:2.3.14-11.SP11_redhat_00001.1.el9eap, 0:2.5.5-24.SP12_redhat_00016.1.el9eap, 0:2.5.5-30.SP12_redhat_00020.1.el9eap, 0:2.16.0-22.redhat_00057.1.el9eap, 0:2.18.8-1.redhat_00003.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:5.0.31-3.SP2_redhat_00001.1.el9eap, 0:7.4.25-2.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA 1.84.0.redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.84.0-1.redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.84.0-1.redhat_00001.1.el9eap
  • Red Hat OpenShift Developer Tools and Services 4.12 1786628667
  • Red Hat OpenShift Developer Tools and Services 4.13 1786628681
  • Red Hat OpenShift Developer Tools and Services 4.14 1786533561
  • Red Hat OpenShift Developer Tools and Services 4.15 1786533565
  • Red Hat OpenShift Developer Tools and Services 4.16 1787125166
  • Red Hat OpenShift Developer Tools and Services 4.17 1787124635
  • Red Hat OpenShift Developer Tools and Services 4.18 1787125069
  • Red Hat OpenShift Developer Tools and Services 4.19 1787124632
  • Red Hat OpenShift Developer Tools and Services 4.20 1787124925
  • Red Hat OpenShift Developer Tools and Services 4.21 1787125311
  • Red Hat OpenShift Developer Tools and Services 4.22 1787124779
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779359423, 1779528224
  • bouncycastle Debian 14 1.86-1

debian advisories DEBIAN-CVE-2026-0636

  • eap8-angus jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap
  • eap8-guava jboss enterprise application platform 8.1 33.0.0-3.jre_redhat_00004.1.el8eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.132-1.Final_redhat_00001.1.el8eap
  • eap8-yasson jboss enterprise application platform 8.1 3.0.4-5.redhat_00007.1.el8eap
  • eap8-jctools jboss enterprise application platform 8.1 4.0.6-1.redhat_00001.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.1 8.1.6-5.GA_redhat_00007.1.el8eap
  • eap8-hibernate jboss enterprise application platform 8.1 6.6.48-1.Final_redhat_00001.1.el8eap
  • eap8-angus-mail jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap

red hat advisories RHSA-2026:53645RHSA-2026:53646RHSA-2026:53644RHSA-2026:18054RHSA-2026:18055

  • bouncycastle openSUSE Tumbleweed 1.84-1.1

opensuse advisories openSUSE-SU-2026:10571-1

Is CVE-2026-0636 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-0636 updated cvss 6.5

bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java

  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat AMQ Clients bcprov-jdk18on Red Hat build of Apache Camel 4 for Quarkus 3 bcprov-jdk18on
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 bcprov-lts8on, bcprov-jdk18on, bcprov-ext-jdk15on Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 jmc
    affected: workaround, no fix available
  • Red Hat Fuse 7 bcprov-jdk15, bcprov-jdk16, bcprov-jdk15on, bcprov-jdk18on, bcprov-jdk15to18, bcprov-ext-jdk15on, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 bcprov-jdk12, bcprov-jdk15, bcprov-jdk15on, bcprov-jdk18on, bcprov-jdk15to18, bcprov-ext-jdk18on
    affected: workaround, no fix available
  • Red Hat Process Automation 7 bcprov-jdk15on, bcprov-jdk15to18 Red Hat Single Sign-On 7 bcprov-jdk15on
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:60249
show 24 more
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:60248
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:60246
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:60250
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat AMQ Broker 7.12.7
    fixed: vendor fix RHSA-2026:14276
  • Red Hat AMQ Broker 7.13.5
    fixed: vendor fix RHSA-2026:14272
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
    fixed: vendor fix RHSA-2026:13631
  • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
    fixed: vendor fix RHSA-2026:17668
  • Red Hat build of Quarkus 3.20.6.SP1 bcprov-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:11720
  • Red Hat build of Quarkus 3.27.3.SP1 bcprov-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:11721
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-2.GA_redhat_00001.1.el7eap, eap7-jackson-core 2.18.8-1.redhat_00003.1.el7eap, eap7-netty 4.1.135-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-jackson-databind 2.18.8-1.redhat_00003.1.el7eap, eap7-netty-all 4.1.135-1.Final_redhat_00001.1.el7eap, +78 more
    fixed: vendor fix RHSA-2026:53644
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-bouncycastle 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pkix 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-prov 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-util 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail 1.84.0-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2026:18054
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-bouncycastle 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pg 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pkix 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-prov 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-util 1.84.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-jmail 1.84.0-1.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2026:18055
  • Red Hat JBoss Enterprise Application Platform 7.4.25
    fixed: vendor fix RHSA-2026:53806
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA bcprov-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:18059
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/openvsx-rhel9 1779528224, devspaces/pluginregistry-rhel9 1779359423
    fixed: vendor fix RHSA-2026:21772
  • Red Hat Cryostat 4 bcprov-jdk18on
    not affected: component not present
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1786628706 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1786628711 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1786628748 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1786628726 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1787124634
    not affected: vulnerable code not present

24 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:M/U:Amber
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 4.0 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.bouncycastle:bcprov-jdk14
>=1.74, <1.80.2
>=1.81, <1.81.1
>=1.82, <1.84
1.80.2
1.81.1
1.84
maven org.bouncycastle:bcprov-jdk15to18
>=1.74, <1.80.2
>=1.81, <1.81.1
>=1.82, <1.84
1.80.2
1.81.1
1.84
maven org.bouncycastle:bcprov-jdk18on
>=1.74, <1.80.2
>=1.81, <1.81.1
>=1.82, <1.84
1.80.2
1.81.1
1.84

Affected products

  • Legion of the Bouncy Castle Inc. BC-JAVA
  • Red Hat Red Hat AMQ Broker 7.12.7
  • Red Hat Red Hat AMQ Broker 7.13.5
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • Red Hat Red Hat build of Quarkus 3.20.6.SP1
  • Red Hat Red Hat build of Quarkus 3.27.3.SP1
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat OpenShift Developer Tools and Services 4.12
  • Red Hat OpenShift Developer Tools and Services 4.13
  • Red Hat OpenShift Developer Tools and Services 4.14
  • Red Hat OpenShift Developer Tools and Services 4.15
  • Red Hat OpenShift Developer Tools and Services 4.16
  • Red Hat OpenShift Developer Tools and Services 4.17
  • Red Hat OpenShift Developer Tools and Services 4.18
  • Red Hat OpenShift Developer Tools and Services 4.19
  • Red Hat OpenShift Developer Tools and Services 4.20
  • Red Hat OpenShift Developer Tools and Services 4.21
  • Red Hat OpenShift Developer Tools and Services 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Cryostat 4
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.