TI-2026-65796 Aliases CVE-2026-17508 GHSA-m3x3-p27c-whhp

Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

LOW 24CWE-770Published 2026-10-02 · Updated 2026-10-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00418 36th percentileScored 2026-11-07

Fix Fixed BC-JAVA (Legion of the Bouncy Castle Inc.): 1.86BC-LTS-JAVA (Legion of the Bouncy Castle Inc.): 2.73.13+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Legion of the Bouncy Castle Inc.	BC-JAVA	before 1.86	1.86	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-JAVA	before 1.86	1.86	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	2.73.0 to before 2.73.13	2.73.13	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	2.73.0 to before 2.73.13	2.73.13	Patch available	CNA
Legion of the Bouncy Castle Inc.	BC-FJA	1.0.0 to before 1.0.13; 2.0.0 to before 2.0.13; 2.1.0 to before 2.1.13	1.0.13, 2.0.13, 2.1.13	Patch available	CNA

BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected before 1.86 Fixed in 1.86 Patch available CNA
BC-JAVA VendorLegion of the Bouncy Castle Inc. Affected before 1.86 Fixed in 1.86 Patch available CNA
BC-LTS-JAVA VendorLegion of the Bouncy Castle Inc. Affected 2.73.0 to before 2.73.13 Fixed in 2.73.13 Patch available CNA
BC-LTS-JAVA VendorLegion of the Bouncy Castle Inc. Affected 2.73.0 to before 2.73.13 Fixed in 2.73.13 Patch available CNA
BC-FJA VendorLegion of the Bouncy Castle Inc. Affected 1.0.0 to before 1.0.13; 2.0.0 to before 2.0.13; 2.1.0 to before 2.1.13 Fixed in 1.0.13, 2.0.13, 2.1.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:bouncycastle:bc-java::::::::	—	—	Legion of the Bouncy Castle Inc.

cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions — — ·Legion of the Bouncy Castle Inc.

Remediation

Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86
Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86
Fix · CNA BC-LTS-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 2.73.13
Fix · CNA BC-LTS-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 2.73.13
Fix · CNA BC-FJA (Legion of the Bouncy Castle Inc.) Fixed in 1.0.13, 2.0.13, 2.1.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-02
Legion of the Bouncy Castle BC-JAVA 1.86
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-65795 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range senderPriority MEDIUM 44
- TI-2026-65797 NTRU leaks private key information by reducing secret values with a non-constant-time integer divisionPriority LOW 35
Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-17508
2026-10-03 Alias added: GHSA-m3x3-p27c-whhp

References

Patch 6

Advisory 1

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017508

TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3

See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences