CVE‐2026‐12185

Title: BKS/UBER keystore allocates from untrusted lengths before integrity check.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

BcKeyStoreSpi.engineLoad() calls loadStore() to parse all keystore entries before validating the trailing HMAC. During parsing, multiple allocations — the certificate chain array (line 722), encoded certificate buffer (line 366), encoded key buffer (line 425), entry byte buffer (line 743), and the PBE salt (line 837) — are sized directly from attacker-controlled readInt() values with no upper bound; the UBER variant similarly allocates the salt before checking its size. An attacker who can supply or tamper with a BKS/UBER keystore file can set any of these length fields to 0x7FFFFFFF, causing the JVM to attempt a ~2 GiB allocation and throw OutOfMemoryError before the integrity check would reject the file. The result is a denial of service in the process that loads the keystore.

The fix was introduced in commit 7bbd7fe5f441.