Read the docs
TI-2026-03020 Aliases CVE-2026-3505GHSA-cj8j-37rh-8475

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Priority MEDIUM 45CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00787 56th percentileScored 2026-11-07
Fix Partial BC-JAVA (Legion of the Bouncy Castle Inc.): 1.80.2, 1.81.1, 1.84org.bouncycastle:bcpg-jdk14 (Maven): 1.84+2 more productsRed Hat: 29 advisoriesRed Hat: 25 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Legion of the Bouncy Castle Inc.BC-JAVA1.74 to before 1.80.2; 1.81 to before 1.81.1; 1.82 to before 1.841.80.2, 1.81.1, 1.84Patch availableCNA
—org.bouncycastle:bcpg-jdk12 (Maven)up to 130—No fix listedGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk14 (Maven)before 1.841.84Patch availableGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk15 (Maven)up to 1.46—No fix listedGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk15to18 (Maven)before 1.841.84Patch availableGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk15on (Maven)up to 1.70—No fix listedGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk16 (Maven)up to 1.46—No fix listedGHSA-cj8j-37rh-8475
—org.bouncycastle:bcpg-jdk18on (Maven)before 1.841.84Patch availableGHSA-cj8j-37rh-8475
  • BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected 1.74 to before 1.80.2; 1.81 to before 1.81.1; 1.82 to before 1.84 Fixed in 1.80.2, 1.81.1, 1.84 Patch available CNA
  • org.bouncycastle:bcpg-jdk12 (Maven) Vendor— Affected up to 130 Fixed in — No fix listed GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk14 (Maven) Vendor— Affected before 1.84 Fixed in 1.84 Patch available GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk15 (Maven) Vendor— Affected up to 1.46 Fixed in — No fix listed GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk15to18 (Maven) Vendor— Affected before 1.84 Fixed in 1.84 Patch available GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk15on (Maven) Vendor— Affected up to 1.70 Fixed in — No fix listed GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk16 (Maven) Vendor— Affected up to 1.46 Fixed in — No fix listed GHSA-cj8j-37rh-8475
  • org.bouncycastle:bcpg-jdk18on (Maven) Vendor— Affected before 1.84 Fixed in 1.84 Patch available GHSA-cj8j-37rh-8475

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*——Legion of the Bouncy Castle Inc.

Remediation

  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.80.2, 1.81.1, 1.84
  • Fix · GHSA-cj8j-37rh-8475 org.bouncycastle:bcpg-jdk14 (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-cj8j-37rh-8475 org.bouncycastle:bcpg-jdk15to18 (Maven) Fixed in 1.84 Advisory →
  • Fix · GHSA-cj8j-37rh-8475 org.bouncycastle:bcpg-jdk18on (Maven) Fixed in 1.84 Advisory →

Red Hat 29 advisories

  • RHSA-2026:76128 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
  • RHSA-2026:76130 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
  • RHSA-2026:76129 Released 2026-10-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
Show 26 more Red Hat advisories
  • RHSA-2026:76134 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2026:76132 Released 2026-10-05 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.13 security update
    • Red Hat Single Sign-On 7.6.13
  • RHSA-2026:70277 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.8.GA com.fasterxml.jackson.core.jackson-core-2.18.9.redhat-00003.jar, com.fasterxml.jackson.core.jackson-databind-2.18.9.redhat-00003.jar, io.netty.netty-codec-4.1.136.Final-redhat-00001.jar +17
  • RHSA-2026:70230 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el10eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el10eap +47
  • RHSA-2026:70228 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el8eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el8eap +47
  • RHSA-2026:70229 Released 2026-09-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.8 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-cli-2.40.0-8.redhat_00024.1.el9eap, eap8-activemq-artemis-commons-2.40.0-8.redhat_00024.1.el9eap +47
  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:53806 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.25
  • RHSA-2026:53646 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
  • RHSA-2026:53645 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 Security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
  • RHSA-2026:53644 Released 2026-08-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • RHSA-2026:13631 Released 2026-05-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)
    • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Legion of the Bouncy Castle BC-JAVA 1.80.2, 1.81.1, 1.84

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-04906 Non-constant time comparisons risk private key leakage in FrodoKEM.Priority MEDIUM 48
    • TI-2025-13517 GOSTCTR implementation unable to process more than 255 blocks correctlyPriority MEDIUM 42
    • TI-2026-04899 PKIX draft CompositeVerifier accepts empty signature sequence as valid.Priority LOW 35
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2026:76134
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27Fixed RHSA-2026:13631
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:53644
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:70230
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054, RHSA-2026:70228
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055, RHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 7.4.25Fixed RHSA-2026:53806
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat JBoss Enterprise Application Platform 8.1.8.GAFixed RHSA-2026:70277
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2026:76128
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2026:76129
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2026:76130
Red Hat Single Sign-On 7.6.13Fixed RHSA-2026:76132
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Not affected: 22 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Clients
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3505
  2. 2026-10-03 Alias added: GHSA-cj8j-37rh-8475
  3. 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
  5. 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
  6. 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
  7. 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 +1 · Red Hat
  8. 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
  9. 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
  10. 2026-10-09 Fix available: RHSA-2026:13631 · Red Hat
  11. 2026-10-09 Fix available: RHSA-2026:70277 · Red Hat
  12. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  13. 2026-10-16 Affected versions changed · Red Hat
  14. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat
  15. 2026-10-21 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.8.GA · Red Hat
  16. 2026-10-30 Affected versions changed · Red Hat
  17. 2026-11-01 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
  • TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
  • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
  • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
  • TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences