Is CVE-2026-63566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63566 being exploited in the wild.

How severe is CVE-2026-63566?

Informational severity, published 2 October 2026.

Which products and versions are affected?

Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0.

Is there a fix for CVE-2026-63566?

Yes: fixed in BouncyCastle.Cryptography 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63566 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63566?

Check whether you run Legion of the Bouncy Castle BouncyCastle.Cryptography at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63566: Bouncy Castle DTLS handshake reassembly memory exhaustion

CVE-2026-63566 · Severity: info · Published 2026-10-02

Bouncy Castle is a cryptography library used in .NET applications to handle secure communications including DTLS (Datagram TLS). An unauthenticated remote attacker can send crafted DTLS handshake fragments that force the library to allocate excessive amounts of memory, exhausting server or client resources and causing a denial of service. The attack requires no authentication and can occur before the handshake is completed.

Technologies: Legion of the Bouncy Castle BouncyCastle.Cryptography. Vendors: Legion of the Bouncy Castle.

Quick answers

Is CVE-2026-63566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63566 being exploited in the wild.
How severe is CVE-2026-63566?: Informational severity, published 2 October 2026.
Which products and versions are affected?: Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0.
Is there a fix for CVE-2026-63566?: Yes: fixed in BouncyCastle.Cryptography 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63566 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63566?: Check whether you run Legion of the Bouncy Castle BouncyCastle.Cryptography at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: BouncyCastle.Cryptography 2.7.0

Technical details

A memory exhaustion vulnerability exists in the DTLS handshake reassembly logic (DtlsReliableHandshake, DtlsReassembler) where the reassembly buffer is allocated based on an attacker-controlled 24-bit length field in the handshake fragment header without validating against the peer's maximum handshake message size limit. A single empty fragment can trigger allocation of up to 16 MB; with 16 pending messages per handshake prior to authentication, this allows exhaustion of approximately 256 MB of memory from an unauthenticated peer. The vulnerability affects both DTLS clients and servers.

Affected products

Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.