CVE‐2026‐15055

Title: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Platform affected: Java 8 and later.

JcePKCSPBEInputDecryptorProviderBuilder.build(password).get(algId) parses PBES2Parameters from an attacker-supplied EncryptedPrivateKeyInfo/PKCS#12/CMS structure and passes the scrypt N/r and PBKDF2 iteration count straight into key derivation (lines 128, 139/143, 184). The same unbounded pattern exists in JceOpenSSLPKCS8DecryptorProviderBuilder, CMS PasswordRecipient handling, and PKCS12PfxPdu MAC verification. Because the KDF executes before any integrity or authenticity check, an attacker who can submit such a structure can force ≈128·N·r bytes of scrypt memory or up to 2^31−1 PBKDF2 HMAC iterations. The result is JVM OOM or a worker thread pinned for hours from a tiny input file.

The fix was introduced in commit 7ab4ee67a013.