CVE-2026-15055 in Bouncy Castle for Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical security flaw that affects multiple versions of the cryptographic library, specifically impacting the PKCS#8 and PBES2 decryption mechanisms. This issue stems from the library's failure to properly validate or limit the Key Derivation Function (KDF) cost parameters provided during decryption operations, allowing attackers to specify arbitrarily high computational costs that can lead to resource exhaustion and denial of service conditions.
The technical flaw manifests when the PKCS#8/PBES2 decryptors process input data containing KDF parameters that specify unbounded computational costs. This behavior directly violates security principles by enabling attackers to manipulate the decryption process through maliciously crafted key derivation parameters, potentially causing excessive CPU consumption and memory allocation during the decryption phase. The vulnerability is categorized under CWE-770, which addresses allocation of resources without limits or throttling, and aligns with ATT&CK technique T1496 for resource exhaustion attacks through cryptographic operations.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to potentially compromise system availability and performance across applications relying on Bouncy Castle for Java. When exploited, the vulnerability can cause significant computational overhead as the library attempts to process excessively high KDF costs, leading to prolonged decryption times that may exhaust system resources or prevent legitimate decryption operations from completing successfully. This affects not only standard Bouncy Castle implementations but also the LTS and FIPS variants, indicating a widespread issue within the library's cryptographic processing pipeline.
Mitigation strategies should focus on implementing proper parameter validation and enforcement of reasonable KDF cost limits within the Bouncy Castle library. Organizations should immediately upgrade to patched versions of Bouncy Castle for Java, specifically version 1.85 or later for standard releases, 2.73.12 or later for LTS versions, and appropriate FIPS versions including bcpkix-fips 1.0.12, 2.0.12, or 2.1.12 for the respective series. Additionally, implementing application-level validation of cryptographic parameters and monitoring for unusual computational resource consumption patterns can provide defensive measures against exploitation attempts while the library upgrades are being implemented.
The vulnerability demonstrates the importance of proper input validation in cryptographic libraries, particularly when dealing with user-provided parameters that directly influence computational complexity and resource allocation. This issue underscores the need for robust security practices in cryptographic implementations where parameter manipulation could lead to significant system impact, making it essential for developers and security teams to maintain updated cryptographic libraries and implement comprehensive testing procedures for security-sensitive applications.