Skip to content
fr Sign in
5.3 Medium

CVE-2026-58063 In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file

Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected products and versions

Product Affected versions Fixed in
BC-JAVA 1.85 earliest → < 1.85 1.85
BC-LTS-JAVA 2.73 2.73.0 → < 2.73.12 2.73.12
BC-FJA 2.1 2.1.0 → < 2.1.3 2.1.3
BC-FJA 2.0 2.0.0 → < 2.0.2 2.0.2
BC-FJA 1.0 1.0.0 → < 1.0.2.7 1.0.2.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of BC-JAVA

The 52 CVEs of BC-JAVA →
CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,… 8.7 High CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every… 7.1 High CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)… 5.9 Medium CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509… 9.2 Critical
Track this CVE