CVEvulnerability

CVE-2026-58063

5.3 MEDIUM Published 2026-08-03 Modified 2026-09-02 Official page ↗
Status
Analyzed
Published
2026-08-03
Last modified
2026-09-02
Assigner
91579145-5d7b-4cc5-b925-a0262ff19630
CVSS 4.0 (91579145-5d7b-4cc5-b925-a0262ff19630)
5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770

Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected configurations

• bouncycastle bc-java (< 1.85) • bouncycastle bouncy castle for java lts (<= 2.73.11) • bouncycastle fips java api (>= 1.0.0 < 1.0.2.7) • bouncycastle fips java api (>= 2.0.0 < 2.0.2) • bouncycastle fips java api (>= 2.1.0 < 2.1.3)

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References