Executive brief
Bouncy Castle for Java FIPS is a cryptographic library used to protect sensitive data through encryption and key management. A flaw in how sensitive key material (AES, DES encryption keys, random number generator seeds) is securely erased from memory can leave encryption keys resident in the Java heap longer than intended, and under heavy load may cause the application to run out of memory. This undermines the security goal of ensuring keys cannot be recovered from memory after use.
Technical details
The vulnerability stems from reliance on Java's Object.finalize() method for zeroising (overwriting) sensitive key material in AES, DESede, DRBG, and key derivation parameter objects. The finalizer thread operates asynchronously and is serviced sequentially, so when key objects are created faster than the finalizer can process them, the pending-finalization queue grows unbounded. This causes keys to remain in the Java heap indefinitely and can contribute to OutOfMemoryError under load. The issue affects Java 9+ where finalization is deprecated; it was not problematic on Java 8/11. The fix replaces finalization with java.lang.ref.Cleaner (available since Java 9) for deterministic, timely zeroisation. Patches are available in bc-fips 1.0.2.7, 2.0.2, and 2.1.3.
Affected products
- Bouncy Castle bc-fips < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3
Timeline
- 2026-08-08: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-08: patched: Patches released: bc-fips 1.0.2.7, 2.0.2, 2.1.3