CVE‐2026‐58062

Title: BCFKS keystore load honours unbounded KDF cost from untrusted file.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

In BcFKSKeyStoreSpi.engineLoad(), the integrity-check structure is parsed from the untrusted keystore bytes and hmacPkbdAlgorithm is set from it before verifyMac() runs. verifyMac() → calculateMac() → generateKey() then feeds the file-supplied KDF parameters directly into PBKDF2 (iterationCount at lines 876/884) or scrypt (N/r at lines 855-857) with no upper bound; PKCS5S2ParametersGenerator only rejects c==0 and SCrypt.generate() enforces no cost cap. An attacker who controls or can modify a .bcfks file can set iterationCount = 2^31-1 or choose scrypt N/r so 128Nr approaches available RAM. The JVM then spends minutes-to-hours of CPU or allocates gigabytes before the MAC mismatch is ever detected.

The fix was introduced in commit 81737a56ef44.