CVE-2026-13586

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description An issue exists involving the PKCS#12 MAC and bag-decryption KDF iteration-count bound, which can lead to a Denial of Service (DoS). KDF refers to a Key Derivation Function, which is a cryptographic algorithm that derives one or more secret keys from a master key or password.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.1.X series to version 2.1.3 or later.