bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

🗓️ 22 Sep 2026 15:35:34Reported by RedHatType

redhat🔗 access.redhat.com👁 9 Views

Unauthenticated remote DoS in BC-JAVA bcpg via unbounded PGP AEAD chunk size memory exhaustion.

Reporter	Title	Published	Views	Family All 467
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle (CVE-2026-0636,CVE-2026-5598,CVE-2026-5588&CVE-2026-3505)	29 Jun 202608:48	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc	22 Jun 202617:25	–	ibm
attackerkb	CVE-2026-3505	15 Apr 202609:06	–	attackerkb
Atlassian	DoS (Denial of Service) org.bouncycastle:bcpg-lts8on Dependency in Bitbucket Data Center	15 Jul 202604:30	–	atlassian
Chainguard	CVE-2026-3505 vulnerabilities	18 Apr 202619:17	–	cgr
Circl	CVE-2026-3505	15 Apr 202613:30	–	circl
CNNVD	Bouncy Castle Java 安全漏洞	15 Apr 202600:00	–	cnnvd
CVE	CVE-2026-3505	15 Apr 202609:06	–	cve
Cvelist	CVE-2026-3505 Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.	15 Apr 202609:06	–	cvelist

Vulners

Node

AND

redhat jboss_enterprise_application_platformRange<8.1el9

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-3505
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-3505
cve	www.cve.org/CVERecord

12 Oct 2026 16:40Current

7.2High risk

Vulners AI Score7.2

CVSS 48.7

CVSS 3.17.5

EPSS0.00882

SSVC

Bouncy Castle BC-JAVA bcpg PGP AEAD resource exhaustion denial of service