CVE‐2026‐59647

Title: CRMF/CMP password-MAC honours unbounded iteration count.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Platform affected: Java 8 and later.

PKMACBuilder's default constructor leaves maxIterations = 0, which disables the iteration-count ceiling check. When a CA/RA verifies a PBM-protected CMP/CRMF message via PKMACValueVerifier.isValid() or ProtectedPKIMessage.verify(), the iteration count is taken directly from the attacker's PBMParameter and fed into a do { K = digest(K); } while (--iter > 0); loop. An attacker can set iterationCount to 2^31-1 and tie up a server thread for hours per request; a handful of requests exhaust the thread pool. The same unbounded-iteration pattern exists for CMS PasswordRecipientInfo in EnvelopedDataHelper.java and BcPasswordRecipient.java, where the PBKDF2 iteration count is attacker-controlled.

The fix was introduced in commit c99d6427d681.