Bouncy Castle for Java vulnerabilities

A side-channel vulnerability exists in the NTRU implementation of Bouncy Castle for Java before version 1.86. The reduction of secret values using the % operator in three helper functions causes execution time to depend on the secret operand (division by a variable), potentially allowing an attacker to recover information about the NTRU private key through timing measurements.

In the MLS implementation (RFC 9420) of Bouncy Castle for Java before 1.86, the uint32 leaf_index is stored as a signed int, allowing a wire value with the top bit set to decode as a negative number. Incorrect comparison in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove allows bypassing membership checks, potentially leading to a DoS attack via unbounded growth of the node list and JVM heap exhaustion.

Bouncy Castle for Java before version 1.74 is affected by an LDAP injection vulnerability. This vulnerability affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates, where the certificate's Subject Name is inserted into an LDAP search filter without proper escaping.