Legion of the Bouncy Castle Inc. Bouncy Castle
Moderate fix1 remedy
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:*:*:*:*:*:*:*
Moderate fix1 remedy
- 2.1.0
Bouncy Castle for Java Out-of-Bounds Write Vulnerability in BC-FIPS
Vulnerability
Patched
An out-of-bounds write vulnerability has been identified in Legion of the Bouncy Castle Inc. Bouncy Castle for Java BC-FIPS, specifically in version 2.1.0. This vulnerability arises in the JCE Cipher.doFinal() method, which can unintentionally overwrite input data when the input and output arrays are the same, and the output is offset differently from the input. This misalignment can lead to the creation of corrupted encryption or decryption results.
Impact
Exploitation of this vulnerability can cause incorrect encryption or decryption, resulting in corrupted data.
Remediation
Users can upgrade to Bouncy Castle for Java version 2.1.1 to address this vulnerability.
Added: Aug 22, 2025, 10:16 AM
Updated: Aug 22, 2025, 10:16 AM
Vulnerability Rating
Custom Algorithm
spread
7.8impact
2.5exploitability
3.3remediation
7.7relevance
0.4threat
0.0urgency
1.4incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.