Executive brief
Bouncy Castle for Java is a widely-used cryptographic library that handles digital certificates and keystores. A flaw in BKS/UBER keystore parsing allows an attacker to trigger excessive memory allocation by providing untrusted length values before the integrity of the keystore data is verified. An attacker can exploit this to cause denial of service by exhausting server memory or crashing applications that process malicious keystore files.
Technical details
The vulnerability exists in BKS and UBER keystore implementations where untrusted length values are used to allocate memory before an integrity check (likely HMAC or similar) is performed on the keystore data. This allows an attacker to craft a malicious keystore file with artificially large length fields, causing the parser to allocate excessive heap memory. The vulnerability affects Bouncy Castle for Java before 1.85 and Bouncy Castle for Java LTS before 2.73.12. No authentication or user interaction is required—any application deserializing or loading a BKS/UBER keystore from an attacker-controlled source is vulnerable. The fix involves validating the integrity of the keystore before performing memory allocation based on untrusted length values.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
Timeline
- 2026-08-03: disclosed