PT-2026-33030

🗓️ 15 Apr 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 7 Views

Unbounded PGP AEAD chunk size in Bouncy Castle Java bcpg causes pre-auth resource exhaustion before version 1.84.

Reporter	Title	Published	Views	Family All 1020
vulnersOsv	app.cash.backfila:client-misk-hibernate (>=2025.05.13.195510-03b951f <=2026.06.09.151811-4851e30), app.cash.backfila:service (>=2025.05.13.195510-03b951f <=2026.06.09.151811-4851e30) +1018 more potentially affected by CVE-2026-3505 via org.bouncycastle:bcpg-jdk18on (>=1.71 <=1.83)	15 Apr 202610:13	–	vulnersosv
vulnersOsv	cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1 <=4.2.3), com.github.WHUTzju:blockchainsdk (=4.1.3) +79 more potentially affected by CVE-2026-5588 via org.bouncycastle:bcpkix-jdk14 (>=1.50 <=1.83)	15 Apr 202618:31	–	vulnersosv
vulnersOsv	ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2093 more potentially affected by CVE-2026-33870 via io.netty:netty-codec-http (>=4.2.0.Alpha1 <=4.2.11.Final)	26 Mar 202618:48	–	vulnersosv
vulnersOsv	org.bouncycastle:bcjmail-debug-jdk18on (>=1.81 <=1.83), org.bouncycastle:bcmail-debug-jdk18on (>=1.81 <=1.83) +1 more potentially affected by CVE-2026-5588 via org.bouncycastle:bcpkix-debug-jdk18on (>=1.81 <=1.83)	15 Apr 202610:13	–	vulnersosv
vulnersOsv	ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0 <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (=0.1.0) +17247 more potentially affected by CVE-2026-5598 via org.bouncycastle:bcprov-jdk18on (>=1.71 <=1.83)	15 Apr 202610:13	–	vulnersosv
vulnersOsv	org.vafer:jdeb (>=0.2 <=0.11) potentially affected by CVE-2026-3505 via org.bouncycastle:bcpg-jdk12 (=130)	17 Apr 202618:31	–	vulnersosv
vulnersOsv	org.bouncycastle:bcmail-debug-jdk14 (>=1.81 <=1.83) potentially affected by CVE-2026-5588 via org.bouncycastle:bcpkix-debug-jdk14 (>=1.81 <=1.83)	15 Apr 202618:31	–	vulnersosv
vulnersOsv	ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2921 more potentially affected by CVE-2026-42585 via io.netty:netty-codec-http (>=4.2.0.Alpha1 <=4.2.12.Final)	7 May 202600:22	–	vulnersosv
vulnersOsv	org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81 <=1.83), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81 <=1.83) +4 more potentially affected by CVE-2026-5598 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81 <=1.83)	15 Apr 202610:13	–	vulnersosv
vulnersOsv	ai.chronon:online_2.13 (>=0.0.25 <=revert-391-thread-0.0.24), ai.chronon:service_2.13 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +4114 more potentially affected by CVE-2026-35554 via org.apache.kafka:kafka-clients (>=2.8.0 <=3.9.1)	7 Apr 202615:30	–	vulnersosv

Source	Link
osv	www.osv.dev/vulnerability/CLEANSTART-2026-DY69070
osv	www.osv.dev/vulnerability/CVE-2024-22257
osv	www.osv.dev/vulnerability/ghsa-cvc6-q2cp-2xhw
osv	www.osv.dev/vulnerability/ghsa-qqpg-mvqg-649v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22257
osv	www.osv.dev/vulnerability/CVE-2026-3260
osv	www.osv.dev/vulnerability/CVE-2026-5598
suse	www.suse.com/security/cve/CVE-2026-5588
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42585
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42579

08 Jun 2026 00:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.7 - 9.8

CVSS 49.9

EPSS0.00952

SSVC