CVE-2026-15055

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 1.0.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.0.12 Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips versions prior to 2.1.12

Description PKCS#8 / PBES2 decryptors process unbounded Key Derivation Function (KDF) cost values provided in the input. A KDF is a cryptographic algorithm that derives one or more secret keys from a master key or password.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 1.0.12 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.0.12 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips to version 2.1.12 or later for the 2.1.X series.