CVE-2026-15055

Published: Aug 3, 2026Modified: Aug 28, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less

Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Affected (5)

Products: Bouncycastle: Bc Java, Bcpkix Fips, Bouncy Castle For Java Lts

Bouncycastle

3 products

Bc Java

Bcpkix Fips

Bouncy Castle For Java Lts

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Before 1.85
Bouncycastle Bcpkix Fips	Before 1.0.12
Bouncycastle Bcpkix Fips	From 2.0.7 to 2.0.12
Bouncycastle Bcpkix Fips	From 2.1.8 to 2.1.12
Bouncycastle Bouncy Castle For Java Lts	Up to 2.73.11

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/bcgit/bc-java/commit/7ab4ee67a0135950001b29b41a96d8a9a5d3b68b

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Patch

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9015055

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Third Party Advisory

Timeline

No history available yet.