CVE-2026-58060 in BC Java
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical memory allocation issue that stems from an unbounded public-key level count in the HSS (Hash Signature Scheme) verification process. This flaw allows malicious actors to trigger excessive memory consumption during signature validation operations, potentially leading to resource exhaustion and denial of service conditions. The vulnerability affects multiple versions across different Bouncy Castle distributions including the standard Java library, LTS releases, and FIPS-compliant variants, indicating a widespread impact throughout the ecosystem.
The technical root cause lies in the lack of proper bounds checking for the HSS public-key level count parameter during signature verification. When processing signatures that contain excessive level counts, the system allocates memory proportional to these unbounded values without adequate constraints. This behavior violates fundamental security principles and can be exploited by attackers who craft specially crafted signatures with artificially inflated level counts to consume excessive system resources.
From an operational perspective, this vulnerability presents significant risks to systems relying on Bouncy Castle for secure signature verification. The impact extends beyond simple denial of service as it can affect system stability, performance degradation, and potentially enable more sophisticated attacks when combined with other vulnerabilities. The affected versions span multiple release lines making remediation efforts complex for organizations maintaining various software stacks.
The vulnerability maps directly to CWE-770 (Allocation of Resources Without Limits or Throttling) which specifically addresses the issue of unbounded resource allocation leading to potential denial of service conditions. Additionally, this flaw can be categorized under ATT&CK technique T1499.004 (Endpoint Denial of Service) as it enables adversaries to consume system resources through legitimate cryptographic operations. The memory exhaustion aspect also aligns with ATT&CK technique T1587.001 (Compromise of Endpoint Resources) where attackers leverage system resources for malicious purposes.
Mitigation strategies should focus on immediate version upgrades to patched releases including Bouncy Castle Java 1.85, LTS 2.73.12, and FIPS versions 2.0.2 or 2.1.3 respectively. Organizations should implement additional monitoring for unusual memory consumption patterns during signature verification operations. Network-level protections such as rate limiting and signature validation timeouts can provide additional defense-in-depth measures while the primary remediation involves updating to patched versions that enforce proper bounds checking on HSS parameter values.