CVE‐2026‐58060

Title: HSS public-key level count unbounded, enabling huge allocation on verify.

Issue affecting: BC before 1.85 (from 1.65), BC-LTS before 2.73.12, BC-FJA before bc-fips 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

In Bouncy Castle's HSS/LMS post-quantum signature code, HSSPublicKeyParameters.getInstance() reads the level count L from the encoded public key with no upper bound, and HSSSignature.getInstance() then reads lminus from the signature, checks it only against attacker-controlled L-1, and allocates new LMSSignedPubKey[lminus]. RFC 8554 caps HSS depth at 8, but that check is applied only in key generation, not on the parse/verify path. The code is reachable from untrusted SubjectPublicKeyInfo via PublicKeyFactory.LMSConverter, the JCA LMSKeyFactorySpi/LMSSignatureSpi, and the CMS RFC 9708 BcHssLmsContentVerifierProviderBuilder. An attacker who supplies both the HSS public key and signature can force a ~17 GB array allocation, causing OutOfMemoryError and denial of service on the verifier.

The fix was introduced in commit 311cabbb6fce and commit 6c9f30b3fdaa.