Executive brief
Bouncy Castle for Java is a widely-used cryptography library that provides encryption, certificate handling, and LDAP integration features. Versions before 1.85 contain an LDAP filter injection vulnerability in the legacy jdk1.4 LDAPStoreHelper component, which could allow an attacker to manipulate LDAP directory queries. An exploitation of this flaw could lead to unauthorized access to directory data, authentication bypass, or lateral movement within enterprise directory systems.
Technical details
This vulnerability is an LDAP filter injection flaw in the jdk1.4 LDAPStoreHelper component of Bouncy Castle. The root cause is insufficient escaping of Distinguished Name (DN) values before they are incorporated into LDAP filter queries. An attacker who can control input used in LDAP operations can inject malicious LDAP filter syntax to alter the logic of directory lookups. The vulnerability requires network access to an LDAP-enabled application using the vulnerable Bouncy Castle version and the legacy jdk1.4 compatibility layer. The fix, released in version 1.85, properly escapes DN values to prevent filter injection. The patch is available in the bc-java repository commit 27c468a.
Affected products
- Bouncycastle Bouncy Castle for Java before 1.85
Timeline
- 2026-08-03: disclosed