← Vulnerability feed

Vulnerability record · CVE-2017-13098 · published 13 December 2017

CVE-2017-13098: Bouncycastle bc-java observable discrepancy vulnerability

Bouncycastle · Bc Java

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."

5.9 CVSS 3.0 Medium EPSS 24% · top 2.2% CWE-203 · Observable discrepancy
5.9CVSS 3.0 base score, v2 4.3
24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
17 Jun 2026Last modified by NVD

Description

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
http://www.kb.cert.org/vuls/id/144389 Issue TrackingMitigationThird Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/102195 Third Party AdvisoryVDB Entry
https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c Issue TrackingPatchThird Party Advisory
https://robotattack.org/ Issue TrackingThird Party Advisory
https://security.netapp.com/advisory/ntap-20171222-0001/ Issue TrackingThird Party Advisory
https://www.debian.org/security/2017/dsa-4072 Issue TrackingThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
http://www.kb.cert.org/vuls/id/144389 Issue TrackingMitigationThird Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/102195 Third Party AdvisoryVDB Entry
https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c Issue TrackingPatchThird Party Advisory
https://robotattack.org/ Issue TrackingThird Party Advisory
https://security.netapp.com/advisory/ntap-20171222-0001/ Issue TrackingThird Party Advisory
https://www.debian.org/security/2017/dsa-4072 Issue TrackingThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html

Track CVE-2017-13098 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-6721Bouncycastle bc-java vulnerabilityThe Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and rem…EPSS 2.4%9.8CVE-2018-1000613Bouncycastle bc-java vulnerabilityLegion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externall…EPSS 4.8%9.3CVE-2026-58062Bouncycastle bc-java improper certificate validation vulnerabilityIn Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Cast…EPSS 0.27%9.3CVE-2026-59650Bouncycastle bc-java improper input validation vulnerabilityIn Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS b…EPSS 0.45%9.3CVE-2026-8763Bouncycastle bc-java improper certificate validation vulnerabilityIn Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java…EPSS 0.45%9.3CVE-2026-59638Bouncycastle bc-java vulnerabilityIn Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bounc…EPSS 0.35%8.7CVE-2026-14682Bouncycastle bc-java vulnerabilityIn Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Cast…EPSS 0.33%8.7CVE-2026-12803Bouncycastle bc-java vulnerabilityIn Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects…EPSS 0.20%

Source: NIST National Vulnerability Database (record CVE-2017-13098), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.