Package Health/org.bouncycastle:bcpg-jdk18on

bcpg-jdk18on

The Bouncy Castle Java APIs for the OpenPGP Protocol. The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services. This jar is designed to work best with Java 1.8 and later.

Latest 1.85org.bouncycastle

Maven

89%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

100

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

License

The artifact includes a license file and the repository also has one, but the detected MIT text does not match the declared Bouncy Castle and Apache licenses. That mismatch warrants clarification despite the package being licensed.

Workflow audit

The only analyzed workflow completed without high-confidence findings and scopes permissions at job level. However, all 3 action references are unpinned, a workflow-hygiene caution because referenced actions can change over time.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-292457 bcpg-jdk18on is vulnerable to Integrity Check Bypass in versions 1.74 - 1.85.	1.74 - 1.85	High
AIKIDO-2026-766129 bcpg-jdk18on is vulnerable to Signature Verification Bypass in versions 1.81 - 1.85.	1.81 - 1.85	High
AIKIDO-2026-417589 bcpg-jdk18on is vulnerable to Incorrect Authorization in versions 1.81 - 1.85.	1.81 - 1.85	Medium
AIKIDO-2026-343055 bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 1.71 - 1.84.	1.71 - 1.84	Medium
AIKIDO-2026-464797 bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.84.	0.0.1 - 1.84	High