Skip to content

CVE‐2026‐13586

Jump to bottom
David Hook edited this page Aug 3, 2026 · 1 revision

Title: PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS).

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

The fix was introduced in commit fa59cc23502f and commit 75d60dfb4ca7.

Clone this wiki locally