Executive brief
Bouncy Castle is a widely-used cryptographic library that handles encrypted key storage. This vulnerability allows an attacker to craft a malicious encrypted private key file that forces the decryption process to consume excessive CPU resources, causing denial of service. Any application using Bouncy Castle to decrypt password-protected keys could hang or crash when processing an attack payload.
Technical details
The vulnerability exists in Bouncy Castle's PKCS#8 PBES2 decryption implementation, which fails to validate or bound the KDF (Key Derivation Function) cost parameter in encrypted input. An attacker can supply a crafted PBES2-encrypted private key with an arbitrarily large iteration count, forcing the library to perform unbounded expensive cryptographic operations. This is a denial-of-service vulnerability accessible to any user who can provide input to the decryption function; no authentication or privilege escalation is possible. The issue affects Bouncy Castle for Java before 1.85, Java LTS before 2.73.12, and FIPS variants in multiple series. Patches are available from the vendor.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.85
- Bouncy Castle Bouncy Castle for Java LTS before 2.73.12
- Bouncy Castle Bouncy Castle for Java FIPS bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series), 2.1.12 (2.1.X series)
Timeline
- 2026-08-03: disclosed