LDAP Injection Vulnerability in LDAPStoreHelper.java
Summary
| CVE | CVE-2026-0636 |
|---|---|
| State | PUBLISHED |
| Assigner | bcorg |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-15 10:16:38 UTC |
| Updated | 2026-07-16 12:17:00 UTC |
| Description | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84. |
Risk And Classification
Primary CVSS: v4.0 5.5 MEDIUM from 91579145-5d7b-4cc5-b925-a0262ff19630
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber
EPSS: 0.005270000 probability, percentile 0.411850000 (date 2026-07-20)
Problem Types: CWE-90 | CWE-90 CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection') | CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 91579145-5d7b-4cc5-b925-a0262ff19630 | Secondary | 5.5 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | CVSS | 5.5 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/S... |
| 3.1 | ADP | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:11721 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:14276 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:18054 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17668 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:18059 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13631 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | |
| access.redhat.com/errata/RHSA-2026:21772 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:11720 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-0636 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:14272 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | |
| access.redhat.com/errata/RHSA-2026:18055 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Prasanth Sundararajan ([email protected]) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-15T10:01:32.911Z | Reported to Red Hat. |
| ADP | 2026-04-15T08:59:12.677Z | Made public. |
Solutions
ADP: RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8
ADP: RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9
ADP: RHSA-2026:14276: Red Hat AMQ Broker 7.12.7
ADP: RHSA-2026:14272: Red Hat AMQ Broker 7.13.5
ADP: RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
ADP: RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1
ADP: RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28
ADP: RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
ADP: RHSA-2026:11720: Red Hat build of Quarkus 3.20.6.SP1
ADP: RHSA-2026:11721: Red Hat build of Quarkus 3.27.3.SP1
Workarounds
ADP: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.