CVE-2026-17508
published 2026-10-02CVE-2026-17508: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being…
PriorityP334medium5.3CVSS 4.0
AVNACLATNPRNUIPVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUAmber
EPSS
0.44%
36.8th percentile
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| devspaces | jetbrains-ide-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
| legion_of_the_bouncy_castle_inc | bc-java | < 1.86 | 1.86 |
| legion_of_the_bouncy_castle_inc | bc-lts-java | >= 2.73.0 < 2.73.13 | 2.73.13 |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| rhbk | keycloak-rhel9 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrust
ghsa_unreviewed·2026-10-03·CVSS 5.3
CVE-2026-97873 [MEDIUM] CWE-770 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrust
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKeyFactory in these families derived with whatever count it was given, including one decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-prote
GHSA
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a s
ghsa_unreviewed·2026-10-02·CVSS 8.2
CVE-2026-17508 [HIGH] CWE-770 In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a s
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceili
Red Hat
org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encrypti
vendor_redhat·2026-10-03·CVSS 5.3
CVE-2026-97873 [MEDIUM] CWE-606 org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encrypti
org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKeyFactory in thes
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-97873 byte-buddy: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
bugzilla·2026-10-13·CVSS 5.3
CVE-2026-97873 [MEDIUM] CVE-2026-97873 byte-buddy: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
CVE-2026-97873 byte-buddy: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count fr
Bugzilla
CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
bugzilla·2026-10-13·CVSS 5.3
CVE-2026-97873 [MEDIUM] CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count
Bugzilla
CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [epel-all]
bugzilla·2026-10-13·CVSS 5.3
CVE-2026-97873 [MEDIUM] CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [epel-all]
CVE-2026-97873 bouncycastle: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count fr
Bugzilla
CVE-2026-97873 org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password
bugzilla·2026-10-03·CVSS 5.3
CVE-2026-97873 [MEDIUM] CVE-2026-97873 org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password
CVE-2026-97873 org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier aliases, and PBKDF1) accepted any count from an encoded PKCS12PBEParams or PBEParameter, narrowing a value beyond the int range with intValue(), and every Cipher, Mac and SecretKey
Bugzilla
CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [epel-all]
bugzilla·2026-10-02·CVSS 8.2
CVE-2026-17508 [HIGH] CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [epel-all]
CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PB
Bugzilla
CVE-2026-17508 bouncycastle: bouncycastle-fips: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters
bugzilla·2026-10-02·CVSS 8.2
CVE-2026-17508 [HIGH] CVE-2026-17508 bouncycastle: bouncycastle-fips: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters
CVE-2026-17508 bouncycastle: bouncycastle-fips: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only
Bugzilla
CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [fedora-all]
bugzilla·2026-10-02·CVSS 8.2
CVE-2026-17508 [HIGH] CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [fedora-all]
CVE-2026-17508 bouncycastle: Bouncy Castle: Denial of Service via unbounded key derivation cost parameters [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of
https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6ahttps://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1ahttps://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385ahttps://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017508
2026-10-02
Published