CVE-2026-58063

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description The BCFKS keystore load process honors an unbounded Key Derivation Function (KDF) cost from untrusted files. A KDF is a cryptographic algorithm that derives one or more secret keys from a master key or password using a hash function. By providing an excessively high cost value, an attacker could potentially cause resource exhaustion during the keystore loading process.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.1.X series to version 2.1.3 or later.