Executive brief
Bouncy Castle is a widely-used cryptographic library for Java applications. A flaw in OpenPGP key derivation (Argon2 S2K) allows attackers to force the use of weak memory and iteration parameters, potentially making encrypted keys easier to crack through brute-force attacks. This could compromise the security of PGP-encrypted data and private keys stored using affected versions.
Technical details
The vulnerability exists in the OpenPGP Argon2 S2K (string-to-key) implementation, where attacker-supplied memory and pass parameters are not properly validated or constrained. An attacker can craft malformed OpenPGP key material that specifies artificially low memory requirements or iteration counts, reducing the computational cost needed to brute-force the derived key. The attack requires network or local access to process attacker-controlled OpenPGP data. Patches are available in Bouncy Castle for Java 1.85+, LTS 2.73.12+, and BC-FJA FIPS versions 1.0.13, 2.0.13, and 2.1.13 or later.
Affected products
- Bouncycastle Bouncy Castle for Java before 1.85
- Bouncycastle Bouncy Castle for Java LTS before 2.73.12
- Bouncycastle Bouncy Castle for Java FIPS (bcpg-fips) before 1.0.13 (1.0.X), 2.0.13 (2.0.X), 2.1.13 (2.1.X)
Timeline
- 2026-08-03: disclosed