Legion of the Bouncy Castle bc-csharp up to 2.6.x HSS/LMS Signature Code memory allocation

Summaryinfo

A vulnerability classified as problematic has been found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. This issue affects some unknown processing of the component HSS/LMS Signature Code. This manipulation causes memory allocation. The identification of this vulnerability is CVE-2026-103603. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component HSS/LMS Signature Code. The manipulation with an unknown input leads to a memory allocation vulnerability. The CWE definition for the vulnerability is CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. As an impact it is known to affect availability. The summary by CVE is:

Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-103603 since 10/01/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.7.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3713). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Bouncy Castle

Productinfo

Vendor

• Legion of the Bouncy Castle

Name

• bc-csharp

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion