CVE-2026-63570 in bc-csharp
Summary
by MITRE • 10/02/2026
Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificates whose issuer links form a cycle, for example two certificates whose AuthorityKeyIdentifier extensions each identify the other's public key. This happens because the chain-building loop stops only when no issuer is found or a certificate links to itself, and keeps no record of certificates already visited. The key-identifier links are followed without checking signatures.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Pkcs12Store.GetCertificateChain within Legion of the Bouncy Castle Inc.'s bc-csharp library prior to version 2.7.0 represents a critical logic flaw that leads to resource exhaustion and denial of service conditions. This issue stems from an implementation error in the certificate chain building algorithm, specifically regarding how it handles circular references among certificates. When an application loads a crafted PKCS#12 file and requests the certificate chain for a specific key entry, the library attempts to resolve the issuer of each certificate by following AuthorityKeyIdentifier extensions. The core technical flaw lies in the loop condition used to traverse these links; the algorithm is designed to terminate only when no issuer is found or if a certificate explicitly references itself as its own issuer. However, it fails to maintain a record of certificates that have already been visited during the traversal process. Consequently, if an attacker supplies a PKCS#12 file containing two or more certificates where their AuthorityKeyIdentifier extensions form a cycle—for instance, Certificate A lists Certificate B as its issuer and Certificate B lists Certificate A as its issuer—the loop enters an infinite state. Because there is no mechanism to detect previously visited nodes in the graph of certificate relationships, the application continues processing indefinitely without returning control to the caller.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service against any system relying on the affected version of bc-csharp for PKCS#12 handling. As the infinite loop persists, it consumes significant CPU resources and allocates memory repeatedly during each iteration of the chain-building process. This unbounded resource consumption eventually leads to an OutOfMemoryException or causes the application thread to hang indefinitely, rendering the service unavailable to legitimate users. The attack vector is relatively straightforward for adversaries who can influence input data; by crafting a malicious PKCS#12 archive with cyclic issuer links, they can trigger this behavior remotely if the file is processed through a vulnerable endpoint such as an API or web server that parses certificate chains without strict validation of circular dependencies. This aligns with CWE-835, which describes loops with unreachable exit conditions, and falls under the broader category of resource exhaustion attacks often associated with CWE-400. In terms of offensive security frameworks like MITRE ATT&CK, this behavior corresponds to techniques used in Denial of Service (T1499) where an attacker disrupts service availability by exhausting system resources through inefficient or infinite processing loops.
Mitigation for this vulnerability requires immediate upgrading to bc-csharp version 2.7.0 or later, which includes the necessary fixes to detect and handle cyclic certificate chains properly. For organizations unable to upgrade immediately, defensive coding practices should be implemented at the application layer by validating PKCS#12 inputs before passing them to the library's chain-building functions. This validation can involve manually traversing the issuer links with a visited set data structure to ensure no cycles exist prior to invoking the vulnerable method. Additionally, implementing timeout mechanisms or circuit breakers for cryptographic operations can help mitigate the impact of such hangs by terminating long-running processes that exceed expected execution times. It is also advisable to enforce strict input validation policies and limit the depth of certificate chain traversal to prevent excessive resource consumption in edge cases where other types of malformed inputs might cause similar issues.