LDAP Injection in Bouncy Castle bcprov 1.741.84 (LDAPStoreHelper)
CVE-2026-0636 Published on April 15, 2026

LDAP Injection Vulnerability in LDAPStoreHelper.java
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-0636 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a LDAP Injection Vulnerability?

The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

CVE-2026-0636 has been classified to as a LDAP Injection vulnerability or weakness.

Products Associated with CVE-2026-0636

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-0636 are published in these products:

Bouncycastle Bc Java

Red Hat Jboss Enterprise Application Platform

Red Hat Amq Broker

Red Hat Apache Camel Quarkus

Red Hat Openshift Devspaces

Red Hat Apache Camel Spring Boot

Red Hat Quarkus

Red Hat Ocp Tools

Red Hat Amq Clients

Red Hat Camel Quarkus

Red Hat Apicurio Registry

Red Hat Debezium

Red Hat Enterprise Linux (RHEL)

Red Hat Jboss Fuse

Red Hat Jboss Enterprise Bpms Platform

Red Hat Single Sign On

Red Hat Cryostat

Red Hat Jboss Data Grid

Red Hat Jbosseapxp

Red Hat Openshift Ai

Red Hat Satellite

Red Hat Amq Streams

Oracle

Red Hat Jboss Enterprise Application Platform Els

Affected Versions

Legion of the Bouncy Castle Inc. BC-JAVA:

Version 1.74 and below 1.80.2 is affected.
Version 1.81 and below 1.81.1 is affected.
Version 1.82 and below 1.84 is affected.

Red Hat AMQ Broker 7.12.7: Red Hat AMQ Broker 7.13.5: Red Hat AMQ Broker 7.14.1: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14:

Version debug-jdk15on and below * is unaffected.

Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14: Red Hat build of Quarkus 3.20.6.SP1: Red Hat build of Quarkus 3.27.3.SP1: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.16.0-22.redhat_00057.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:1.5.26-2.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:1.10.0-46.Final_redhat_00044.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:7.4.25-2.GA_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.16.0-22.redhat_00057.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.3.14-11.SP11_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:1.5.26-2.Final_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.18.8-1.redhat_00003.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:5.0.31-3.SP2_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:1.10.0-46.Final_redhat_00044.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:4.1.135-1.Final_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:4.1.135-1.Final_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.5.5-30.SP12_redhat_00020.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.5.5-24.SP12_redhat_00016.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:2.2.40-1.SP3_redhat_00001.1.el8eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8:

Version 0:7.4.25-2.GA_redhat_00001.1.el8eap and below * is unaffected.