fix(deps): update dependency org.bouncycastle:bcprov-jdk18on to v1.84 [security] by renovate[bot] · Pull Request #380 · OpenIntegrationEngine/engine

renovate · 2026-07-24T13:16:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
org.bouncycastle:bcprov-jdk18on (source)	`1.78.1` → `1.84`

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

CVE-2025-14813 / GHSA-574f-3g2m-x479

More information

Details

The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Legion of the Bouncy Castle BC-JAVA bcprov core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with backported fixes in 1.80.2 and 1.81.1).

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Bouncy Castle has an LDAP injection

CVE-2026-0636 / GHSA-c3fc-8qff-9hwx

More information

Details

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.84.

Severity

CVSS Score: 5.5 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-24T13:22:03Z

Test Results

0 tests - 655 0 ✅ - 655 0s ⏱️ - 1m 19s
0 suites - 109 0 💤 ± 0
0 files - 109 0 ❌ ± 0

Results for commit 1628d4b. ± Comparison against base commit f421b3c.

♻️ This comment has been updated with latest results.

jbeckers · 2026-07-24T17:48:21Z

@@ -20,7 +20,7 @@ aws-json-protocol = { module = "software.amazon.awssdk:aws-json-protocol", versi
 aws-query-protocol = { module = "software.amazon.awssdk:aws-query-protocol", version = "2.15.28" }
 aws-xml-protocol = { module = "software.amazon.awssdk:aws-xml-protocol", version = "2.15.28" }
 bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version = "1.78.1" }


jbeckers · 2026-07-24T17:49:00Z

 bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version = "1.78.1" }
-bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version = "1.78.1" }
+bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version = "1.84" }
 bcutil-jdk18on = { module = "org.bouncycastle:bcutil-jdk18on", version = "1.78.1" }


renovate did not start a PR for bcutil, but it should be kept in sync with the other two.

… [security]

renovate · 2026-07-31T00:36:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q --write-verification-metadata sha256 dependencies
FAILURE: Build completed with 2 failures.
1: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
> Could not resolve org.owasp:dependency-check-core:12.2.2.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve org.owasp:dependency-check-core:12.2.2.
> Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
> Could not resolve org.owasp:dependency-check-utils:12.2.2.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve org.owasp:dependency-check-utils:12.2.2.
> Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
> Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
> Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests
* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================
2: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
> Could not resolve org.owasp:dependency-check-core:12.2.2.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve org.owasp:dependency-check-core:12.2.2.
> Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
> Could not resolve org.owasp:dependency-check-utils:12.2.2.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve org.owasp:dependency-check-utils:12.2.2.
> Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
> Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
Required by:
root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
> Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
> Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
> Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests
* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================
BUILD FAILED in 34s

renovateBot requested a review from a teamJuly 24, 2026 13:16

renovateBot added dependencies Dependency updates java Java / Gradle dependencies labels Jul 24, 2026

renovateBot requested review from NicoPiel, gibson9583, jonbartels, kayyagari, kpalang, mgaffigan and ssrowe July 24, 2026 13:16

renovateBot added dependencies Dependency updates java Java / Gradle dependencies labels Jul 24, 2026

jonbartels previously approved these changes Jul 24, 2026
View reviewed changes

jbeckers reviewed Jul 24, 2026
View reviewed changes

jbeckers suggested changes Jul 24, 2026
View reviewed changes

jbeckers mentioned this pull request Jul 24, 2026
fix(deps): update dependency org.bouncycastle:bcpkix-jdk18on to v1.84 [security] #379
Open
1 task

mgaffigan previously approved these changes Jul 24, 2026
View reviewed changes

NicoPiel previously approved these changes Jul 24, 2026
View reviewed changes

renovateBotforce-pushed the renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability branch from 4f5f111 to 67b4a78Compare July 24, 2026 23:09

mgaffigan force-pushed the renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability branch from 67b4a78 to c2a2857Compare July 24, 2026 23:12

renovateBotforce-pushed the renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability branch 2 times, most recently from f4f6669 to 7b7737fCompare July 27, 2026 13:26

renovateBot dismissed stale reviews from mgaffigan, NicoPiel, and jonbartels via cccb9cbJuly 28, 2026 13:31

renovateBotforce-pushed the renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability branch 2 times, most recently from cccb9cb to fa10959Compare July 28, 2026 20:31

fix(deps): update dependency org.bouncycastle:bcprov-jdk18on to v1.84…
1628d4b
… [security]

renovateBotforce-pushed the renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability branch from fa10959 to 1628d4bCompare July 31, 2026 00:36

Navigation Menu

Uh oh!

fix(deps): update dependency org.bouncycastle:bcprov-jdk18on to v1.84 [security] - #380

fix(deps): update dependency org.bouncycastle:bcprov-jdk18on to v1.84 [security]#380
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-org.bouncycastle-bcprov-jdk18on-vulnerability

renovateBot commented Jul 24, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Jul 24, 2026•
edited
Loading

Uh oh!

jbeckersJul 24, 2026

Uh oh!

jbeckersJul 24, 2026

Uh oh!

renovateBot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

renovateBot commented Jul 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

Details

Severity

References

Bouncy Castle has an LDAP injection

Details

Severity

References

Configuration

Uh oh!

github-actionsBot commented Jul 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

jbeckersJul 24, 2026

Choose a reason for hiding this comment

Uh oh!

jbeckersJul 24, 2026

Choose a reason for hiding this comment

Uh oh!

renovateBot commented Jul 31, 2026

⚠️ Artifact update problem

File name: gradle/libs.versions.toml

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

renovateBot commented Jul 24, 2026•
edited
Loading

github-actionsBot commented Jul 24, 2026•
edited
Loading