Quick answers
- Is CVE-2026-17507 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-17507 being exploited in the wild.
- How severe is CVE-2026-17507?
- Informational severity, published 2 October 2026.
- Which products and versions are affected?
- Bouncy Castle for Java before 1.86.
- Is there a fix for CVE-2026-17507?
- Yes: fixed in Bouncy Castle for Java 1.86. Until then: Upgrade to Bouncy Castle for Java 1.86 or later, which interprets leaf_index as unsigned via Integer.toUnsignedLong() to properly reject out-of-range senders.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-17507 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-17507?
- Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Bouncy Castle for Java 1.86
Upgrade to Bouncy Castle for Java 1.86 or later, which interprets leaf_index as unsigned via Integer.toUnsignedLong() to properly reject out-of-range senders.</anigation> </invoke>
Technical details
The MLS implementation stores RFC 9420's uint32 leaf_index as a signed int, causing wire values with the top bit set to decode as negative numbers. The GroupKeySet.SecretTree.hasLeaf and Group.validateRemove methods perform signed comparisons against the tree's leaf count, allowing negative values to bypass the bounds check. An attacker can then exploit subsequent unsigned arithmetic in NodeIndex.parent() to cause unbounded node list allocation until JVM heap exhaustion, triggering denial of service.
Affected products
- Bouncy Castle Bouncy Castle for Java before 1.86
Timeline
- 2026-10-02: disclosed