Legion of the Bouncy Castle BC-FJA up to 1.0.2.6/2.0.1/2.1.2 Finalizer finalize allocation of resources

Summaryinfo

A vulnerability identified as critical has been detected in Legion of the Bouncy Castle BC-FJA up to 1.0.2.6/2.0.1/2.1.2. This vulnerability affects the function finalize of the component Finalizer. The manipulation leads to allocation of resources. This vulnerability is uniquely identified as CVE-2026-13505. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Legion of the Bouncy Castle BC-FJA up to 1.0.2.6/2.0.1/2.1.2. This issue affects the function finalize of the component Finalizer. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-13505 since 06/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.0.2.7, 2.0.2 or 2.1.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Legion of the Bouncy Castle

Name

• BC-FJA

Version

• 1.0.2.0
• 1.0.2.1
• 1.0.2.2
• 1.0.2.3
• 1.0.2.4
• 1.0.2.5
• 1.0.2.6
• 2.0.0
• 2.0.1
• 2.1.0
• 2.1.1
• 2.1.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion