CVE‐2026‐59644

Title: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

Issue affecting: BC before 1.85 (from 1.73).

Fixed versions: BC 1.85.

Platform affected: Java 8 and later.

In Bouncy Castle's MLS implementation, GroupKeySet.HashRatchet.get(int generation) loops 'while (nextGeneration < generation) next();' and caches every intermediate KeyGeneration in an unbounded HashMap. The generation value comes directly from the SenderData of an incoming PrivateMessage, a 32-bit integer fully controlled by the sender and encrypted only under the group-shared sender_data_secret, so any authenticated member can set it. PrivateMessage.unprotect() passes this value to keys.get() after only a hasLeaf() check and before any per-message signature verification. A single malicious member can thus send generation = 0x7FFFFFFF and force every other member into ~2 billion HKDF iterations and multi-gigabyte cache growth.

The fix was introduced in commit 610d8757d855.