PT-2026-69160 · Unknown · Bouncy Castle For Java
CVE-2026-8798
·
Published
2026-08-08
·
Updated
2026-08-08
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber |
Name of the Vulnerable Software and Affected Versions
Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3
Description
On Intel platforms, the native entropy source retries CPU entropy instructions without a bound. The JNI seeding routine continuously re-issues instructions as long as the carry flag reports failure. A persistent failure of the on-chip entropy source—caused by hardware faults, DRBG exhaustion due to multi-core contention, or a hypervisor not providing the instruction—can cause the calling thread to loop indefinitely within the JNI call. Because this process cannot be interrupted or timed out, any operation relying on the native entropy source may hang, resulting in a denial of service for the application.
Recommendations
Update Bouncy Castle for Java FIPS (BC-FJA) to version 2.1.3 or later.
Exploit
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bouncy Castle For Java