CVE-2026-58063

Published: Aug 3, 2026Modified: Sep 2, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less

Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected (5)

Products: Bouncycastle: Bc Java, Bouncy Castle For Java Lts, Fips Java Api

Bouncycastle

3 products

Bc Java

Bouncy Castle For Java Lts

Fips Java Api

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Before 1.85
Bouncycastle Bouncy Castle For Java Lts	Up to 2.73.11
Bouncycastle Fips Java Api	From 1.0.0 to 1.0.2.7
Bouncycastle Fips Java Api	From 2.0.0 to 2.0.2
Bouncycastle Fips Java Api	From 2.1.0 to 2.1.3

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Patch

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Third Party AdvisoryPatch

Timeline

No history available yet.