CVE-2026-103604

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Inefficient algorithmic complexity in X.509 distinguished name string conversion within the X509Name.ToString and IetfUtilities.ValueToString functions allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion. This occurs when processing a certificate, CRL, certification request, or other structure containing a long attribute value composed of leading or trailing spaces or characters that require escaping, such as commas. The issue arises because each escaping backslash is inserted into the buffer being scanned, causing the workload to grow quadratically relative to the value length. Applications are susceptible when converting such names to strings for logging or display, or when comparing them using the IetfUtilities.RdnAreEqual function, as seen in PKIX path validation for directoryName name constraints.

Recommendations Update bc-csharp to version 2.7.0 or later.