Executive brief
Bouncy Castle for Java FIPS is a widely-used cryptographic library that includes a native entropy source for random number generation on Intel processors. A flaw in this entropy source can cause the application to hang indefinitely when accessing random numbers, whether due to hardware failure, resource exhaustion, or virtualization issues. This denial of service affects any application relying on Bouncy Castle's entropy generation, potentially disrupting critical services.
Technical details
The vulnerability is an infinite loop (CWE-835) in the JNI native entropy source used on Intel platforms. The seeding routine calls the RDSEED and RDRAND CPU instructions without any bound on retry attempts; when these instructions fail (signaled via carry flag), the code re-issued them indefinitely rather than timing out or throwing an exception. This could occur due to hardware faults, DRBG exhaustion from high contention, or hypervisors that don't support the instructions. The attack vector is network-accessible since any remote operation triggering entropy generation can hang the application thread. The vulnerability affects bc-fips versions 2.1.0 through 2.1.2; it is fixed in version 2.1.3 which bounds retries (200 for RDSEED, 20 for RDRAND) and throws on exhaustion.
Affected products
- Bouncy Castle bc-fips 2.1.0 through 2.1.2
Timeline
- 2026-08-08: disclosed
- 2026-08-08: patched: Fix released in bc-fips 2.1.3