CVE-2026-58063 in BC-JAVA
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java represents a critical security flaw that enables malicious actors to exploit resource exhaustion through improper handling of Key Derivation Function cost parameters during keystore loading operations. This issue affects multiple versions of the Bouncy Castle cryptographic library across different release streams including standard Java, Long Term Support, and FIPS-compliant variants. The core problem stems from the library's failure to validate or impose reasonable bounds on KDF cost parameters when reading keystore files from untrusted sources, creating a potential denial of service vector that can be exploited by attackers to consume excessive system resources.
The technical implementation flaw resides in how Bouncy Castle processes keystore files containing BCFKS (Bouncy Castle File Keystore) format data. When loading these keystores, the library directly accepts and applies KDF cost parameters without implementing any validation mechanisms or reasonable upper limits on these values. This allows an attacker to craft malicious keystore files with extremely high KDF cost settings that can cause significant computational overhead during the loading process, effectively enabling resource exhaustion attacks against systems utilizing the affected library versions. The vulnerability affects both standard and FIPS-compliant implementations across multiple release series, indicating a fundamental design issue rather than a simple patchable bug.
The operational impact of this vulnerability extends beyond simple denial of service scenarios to potentially compromise system availability and performance across applications relying on Bouncy Castle for Java cryptographic operations. Attackers can exploit this weakness by creating specially crafted keystore files that force the library to perform computationally intensive key derivation operations with excessively high cost parameters, leading to resource exhaustion that can affect entire application servers or systems processing multiple such requests. This vulnerability is particularly concerning in environments where keystore files are processed from untrusted sources or when applications handle user-provided cryptographic materials without proper validation mechanisms.
Mitigation strategies for this vulnerability require immediate patching of affected Bouncy Castle library versions to implement proper bounds checking on KDF cost parameters during keystore loading operations. Organizations should upgrade to the latest stable releases including Bouncy Castle Java 1.85, LTS 2.73.12, and respective FIPS versions that contain fixes for this resource exhaustion issue. Additionally, system administrators should implement proper input validation procedures for any keystore files processed by applications using Bouncy Castle libraries, ensuring that cryptographic material from untrusted sources undergoes proper verification before being loaded into memory. The implementation of these mitigations aligns with industry best practices for preventing resource exhaustion attacks and follows established security frameworks such as those referenced in CWE-400 and ATT&CK techniques related to resource exhaustion and denial of service. Organizations should also consider implementing monitoring solutions to detect unusual computational patterns that might indicate exploitation attempts targeting this vulnerability.