CVE-2026-63566

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description An issue exists in the DTLS handshake reassembly process within DtlsReliableHandshake and DtlsReassembler. A remote unauthenticated DTLS peer can trigger a denial of service through memory exhaustion by sending crafted handshake message fragments. This occurs because the reassembly buffer for incoming handshake messages is allocated based on the 24-bit length declared in the fragment header without verifying it against the peer's maximum handshake message size. Consequently, a fragment with no payload can force an allocation of nearly 16 MB for each of the 16 pending messages per handshake before authentication. Both DTLS servers and clients are affected, while TLS remains unaffected.

Recommendations Update bc-csharp to version 2.7.0 or later.