CVE-2026-17508

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Bouncy Castle for Java LTS versions prior to 2.73.13 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.0.13 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.1.13

Description Several password-based key derivation function (KDF) entry points process cost parameters from untrusted input without proper bounding. This allows a small input to trigger an excessive amount of computational work before any password or integrity check can reject the request. The affected paths include the RFC 9579 PBMAC1 MAC calculator builders, which use the PBKDF2 iteration count and derived-key length from PBMAC1Params via JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator (accessed from PKCS12PfxPdu.isMacValid). Additionally, the scrypt parallelization parameter p in PKCS#8 and PKCS#12 cost guards is not bounded, allowing the memory ceiling to be bypassed since the scratch buffer scales with r times p. Other affected components include the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2) and the bcrypt round count read from encrypted OpenSSH v1 private key kdfoptions.

Recommendations Update Bouncy Castle for Java to version 1.86 or later. Update Bouncy Castle for Java LTS to version 2.73.13 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 1.0.13 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.0.13 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.1.13 or later for the 2.1.X series. Configure the org.bouncycastle.openssh.max rounds property to limit the OpenSSH round count.