Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by bcorg

CVE-2026-3505Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

High 7.5

In plain English

A high-severity resource allocation without limits in BC-JAVA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bouncycastleno fix listedDEBIAN-CVE-2026-3505
Debian:13bouncycastleno fix listedDEBIAN-CVE-2026-3505
Debian:14bouncycastle1.86-1DEBIAN-CVE-2026-3505
Mavenorg.bouncycastle:bcpg-jdk12no fix listedGHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk141.84GHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk15no fix listedGHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk15onno fix listedGHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk15to181.84GHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk16no fix listedGHSA-cj8j-37rh-8475
Mavenorg.bouncycastle:bcpg-jdk18on1.84GHSA-cj8j-37rh-8475
Ubuntu:25.10bouncycastleno fix listedUBUNTU-CVE-2026-3505
Ubuntu:26.04:LTSbouncycastleno fix listedUBUNTU-CVE-2026-3505
Ubuntu:26.10bouncycastleno fix listedUBUNTU-CVE-2026-3505

Affected products (as reported)

VendorProductVersions
Legion of the Bouncy Castle Inc. BC-JAVA 1.74 – before 1.80.21.81 – before 1.81.11.82 – before 1.84

Weakness: CWE-770, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References