CVE-2026-8798

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description On Intel platforms, the native entropy source retries CPU entropy instructions without a bound. The JNI seeding routine continuously re-issues instructions as long as the carry flag reports failure. A persistent failure of the on-chip entropy source—caused by hardware faults, DRBG exhaustion due to multi-core contention, or a hypervisor not providing the instruction—can cause the calling thread to loop indefinitely within the JNI call. Because this process cannot be interrupted or timed out, any operation relying on the native entropy source may hang, resulting in a denial of service for the application.

Recommendations Update Bouncy Castle for Java FIPS (BC-FJA) to version 2.1.3 or later.