Junglewise Threat Intelligence

CVE-2026-3505: Bouncy Castle BC-JAVA resource exhaustion in PGP AEAD processing

CVE-2026-3505 · Severity: high · CVSS 4 · Published 2026-04-15

Vendors: Maven, Legion of the Bouncy Castle Inc..

Executive brief

Bouncy Castle Java (BC-JAVA) is a widely used library for encryption and secure communications. A vulnerability in its PGP module allows an attacker to send a specially crafted message that causes the application to consume excessive memory. This can lead to a complete service outage (Denial of Service) by crashing the Java Virtual Machine before the user is even authenticated.

Technical details

An uncontrolled resource consumption vulnerability exists in the Bouncy Castle Java (BC-JAVA) OpenPGP (bcpg) module. The root cause is a lack of validation for the 'chunkSize' field within AEAD-encrypted data packets (AEADEncDataPacket.java). A remote, unauthenticated attacker can provide a crafted AEAD chunk header with an unbounded or extremely large chunk size, leading to memory exhaustion and a crash of the Java Virtual Machine (JVM). This occurs during the initial packet parsing phase, making it a pre-authentication attack. The issue is fixed in versions 1.80.2, 1.81.1, and 1.84 by enforcing RFC 9580 limits on the chunkSize (0-16).

Affected products

  • Legion of the Bouncy Castle Inc. BC-JAVA bcpg 1.74 to 1.80.1, 1.81, 1.82 to 1.83

Timeline

  • 2026-03-04: patched: Fix committed to repository
  • 2026-04-15: advisory: Initial NVD publication
  • 2026-05-18: other: Advisory updated with specific version ranges and technical details

References