Vulnerability · Published Oct 2, 2026 · Assigned by bcorg
CVE-2026-63570Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links
High 7.1
In plain English
A high-severity infinite loop in bc-csharp from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificates whose issuer links form a cycle, for example two certificates whose AuthorityKeyIdentifier extensions each identify the other's public key. This happens because the chain-building loop stops only when no issuer is found or a certificate links to itself, and keeps no record of certificates already visited. The key-identifier links are followed without checking signatures.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Legion of the Bouncy Castle Inc. | bc-csharp | 0 – before 2.7.0 |
Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N