Skip to main content

Allocation of Resources Without Limits or Throttling in org.bouncycastle:bc-fips

CVE-2026-58063

  • org.bouncycastle:bc-fips
  • org.bouncycastle:bcprov-jdk18on
  • org.bouncycastle:bcprov-lts8on
Medium
5.3/10

Summary

In Bouncy Castle for Java prior to 1.85, BCFKS keystore load honours unbounded KDF cost from an untrusted file. This issue also affects Bouncy Castle for Java LTS prior to 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) prior to bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published