CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification

[
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "bc-csharp",
    "collectionURL": "https://www.nuget.org/packages/BouncyCastle.Cryptography",
    "packageName": "BouncyCastle.Cryptography",
    "repo": "https://github.com/bcgit/bc-csharp",
    "programFiles": [
      "crypto/src/pqc/crypto/lms/HSSPublicKeyParameters.cs",
      "crypto/src/pqc/crypto/lms/HSSSignature.cs"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]