CVE‐2026‐12852

Title: MLS wire decoder allocates attacker-declared opaque length before bounds check.

Issue affecting: BC before 1.85 (from 1.73).

Fixed versions: BC 1.85.

Platform affected: Java 8 and later.

In bc-java's MLS codec, MLSInputStream.readOpaque() decodes a Varint length (max 0x3FFFFFFF ≈ 1 GiB) and immediately calls stream.readAll(size), which performs new byte[size] before checking that enough bytes remain. readOpaque() is hit on the very first fields of unauthenticated wire structures (PublicMessage FramedContent.group_id, KeyPackage.init_key, Welcome.encrypted_group_info, PrivateMessage.group_id), so the allocation occurs before any signature or MAC verification. An attacker who can deliver raw MLS bytes sends a ~6-byte message whose first opaque length varint is 0xBFFFFFFF; each such message forces a ~1 GiB allocation. A handful of concurrent messages exhausts the JVM heap and crashes the process.

The fix was introduced in commit a747038bb5bb.