CVE-2022-45146

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

• CWE-416

• https://github.com/bcgit/bc-java/wiki/CVE-2022-45146Exploit, Third Party Advisory
• https://mvnrepository.com/artifact/org.bouncycastle/bc-fips
• https://www.bouncycastle.org/latest_releases.htmlRelease Notes, Vendor Advisory
• https://github.com/bcgit/bc-java/wiki/CVE-2022-45146Exploit, Third Party Advisory
• https://mvnrepository.com/artifact/org.bouncycastle/bc-fips
• https://www.bouncycastle.org/latest_releases.htmlRelease Notes, Vendor Advisory

Published

Nov 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45140The configuration backend allows an unauthenticated user to …9.8
• CVE-2022-45141Since the Windows Kerberos RC4-HMAC Elevation of Privilege V…9.8
• CVE-2022-45142The fix for CVE-2022-3437 included changing memcmp to be con…7.5
• CVE-2022-45143The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to …7.5
• CVE-2022-45144Algoo Tracim before 4.4.2 allows XSS via HTML file upload.6.1
• CVE-2022-45145egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary…9.8
• CVE-2022-45147A vulnerability has been identified in SIMATIC PCS neo V4.0 …8.5
• CVE-2022-45148Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-45149A vulnerability was found in Moodle which exists due to insu…5.4
• CVE-2022-4515A flaw was found in Exuberant Ctags in the way it handles th…7.8
• CVE-2022-45150A reflected cross-site scripting vulnerability was discovere…6.1
• CVE-2022-45151The stored-XSS vulnerability was discovered in Moodle which …5.4