CVE-2026-3505 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

[
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-JAVA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
    "packageName": "bcpg",
    "repo": "https://github.com/bcgit/bc-java",
    "modules": [
      "pg"
    ],
    "programFiles": [
      "AEADEncDataPacket.java",
      "BcAEADUtil.java",
      "JceAEADUtil.java",
      "OperatorHelper.java"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.74",
        "lessThan": "1.80.2",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "1.81",
        "lessThan": "1.81.1",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "1.82",
        "lessThan": "1.84",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]