# CVE-2026-13505: Bouncy Castle FIPS sensitive key material zeroisation failure

Source: https://junglewise.ai/threats/cve-2026-13505-bouncy-castle-fips-sensitive-key-material-zeroisation-failure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13505 · Severity: high · CVSS 4 · Published 2026-08-08

Bouncy Castle for Java FIPS is a cryptographic library used to protect sensitive data through encryption and key management. A flaw in how sensitive key material (AES, DES encryption keys, random number generator seeds) is securely erased from memory can leave encryption keys resident in the Java heap longer than intended, and under heavy load may cause the application to run out of memory. This undermines the security goal of ensuring keys cannot be recovered from memory after use.

Technologies: [org.bouncycastle:bc-fips (Maven)](https://junglewise.ai/threats/technologies/org-bouncycastle-bc-fips). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-13505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13505 being exploited in the wild.

**How severe is CVE-2026-13505?** High severity, with a CVSS score of 4, published 8 August 2026.

**Which products and versions are affected?** org.bouncycastle:bc-fips (Maven) ECOSYSTEM:introduced=0,fixed=1.0.2.7.

**Is there a fix for CVE-2026-13505?** Yes. org.bouncycastle:bc-fips (Maven): upgrade to 1.0.2.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13505?** Check whether you run org.bouncycastle:bc-fips (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.bouncycastle:bc-fips (Maven): upgrade to 1.0.2.7 or later

  ```sh
  # set org.bouncycastle:bc-fips to 1.0.2.7 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability stems from reliance on Java's Object.finalize() method for zeroising (overwriting) sensitive key material in AES, DESede, DRBG, and key derivation parameter objects. The finalizer thread operates asynchronously and is serviced sequentially, so when key objects are created faster than the finalizer can process them, the pending-finalization queue grows unbounded. This causes keys to remain in the Java heap indefinitely and can contribute to OutOfMemoryError under load. The issue affects Java 9+ where finalization is deprecated; it was not problematic on Java 8/11. The fix replaces finalization with java.lang.ref.Cleaner (available since Java 9) for deterministic, timely zeroisation. Patches are available in bc-fips 1.0.2.7, 2.0.2, and 2.1.3.

## Affected products

- Bouncy Castle bc-fips < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3

## Identifiers

- CVE-2026-13505
- GHSA-98j2-6v39-78w8

## Timeline

- 2026-08-08: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-08: patched: Patches released: bc-fips 1.0.2.7, 2.0.2, 2.1.3

## Related threats

- [Bouncy Castle Java FIPS infinite loop in entropy source on Intel platforms](https://junglewise.ai/threats/cve-2026-8798-bouncy-castle-java-fips-infinite-loop-in-entropy-source-on-intel)
- [Bouncy Castle ASN.1 sequence nesting-depth guard bypass](https://junglewise.ai/threats/cve-2026-13506-bouncy-castle-asn-1-sequence-nesting-depth-guard-bypass)
- [Bouncy Castle Name Constraints bypass via trailing dot in rfc822Name and URI](https://junglewise.ai/threats/cve-2026-8763-bouncy-castle-name-constraints-bypass-via-trailing-dot-in)
- [Bouncy Castle BC-LTS GCM decryption failure on X86_64 Linux](https://junglewise.ai/threats/cve-2026-8149-bouncy-castle-bc-lts-gcm-decryption-failure-on-x86-64-linux)
- [Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules)](https://junglewise.ai/threats/cve-2025-12194-bouncy-castle-vulnerable-to-uncontrolled-resource-consumption)