Denial Of Service (DoS)

Bouncy Castle is vulnerable to Denial Of Service DoS. The vulnerability is due to an unbounded HSS public-key level count during verification, which allows an attacker to trigger excessive memory allocation and potentially cause a denial-of-service condition...

CVE-2026-58060

CVE-2026-58060 affects Bouncy Castle for Java: before 1.85, the HSS public-key level count is unbounded, allowing huge allocations during verify. The issue also impacts Bouncy Castle for Java LTS before 2.73.12, and BC-FJA (FIPS) before bc-fips 2.0.2 (2.0.x) and 2.1.3 (2.1.x). The connected docum...