CVE-2026-13505

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description Sensitive key material within the AES and DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and the PBKD and scrypt parameter classes was zeroised during garbage collection by overriding Object.finalize(). In JVMs later than Java 8 and Java 11, where finalization is deprecated, this process can lead to a pending-finalization queue that grows without bound if objects are allocated faster than the single finalizer thread can retire them. This can result in an OutOfMemoryError under load and allows sensitive key material to remain resident in the heap longer than intended, undermining the zeroisation process.

Recommendations Update Bouncy Castle for Java FIPS (BC-FJA) 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.1.X series to version 2.1.3 or later.