CVE-2026-59647

Published: Aug 3, 2026Modified: Aug 28, 2026

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less

Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Affected (5)

Products: Bouncycastle: Bc Java, Bcpkix Fips, Bouncy Castle For Java Lts

Bouncycastle

3 products

Bc Java

Bcpkix Fips

Bouncy Castle For Java Lts

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Before 1.85
Bouncycastle Bcpkix Fips	Before 1.0.12
Bouncycastle Bcpkix Fips	From 2.0.7 to 2.0.12
Bouncycastle Bcpkix Fips	From 2.1.8 to 2.1.12
Bouncycastle Bouncy Castle For Java Lts	Up to 2.73.11

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/bcgit/bc-java/commit/c99d6427d6818d04165b07b45dfda96f2b384c53

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Patch

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059647

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Third Party Advisory

Timeline

No history available yet.