CVE‐2026‐59648

Title: OpenPGP Argon2 S2K honours attacker-chosen memory and passes.

Issue affecting: BC before 1.85 (from 1.71), BC-LTS before 2.73.12, BC-FJA before bcpg-fips 1.0.13 (from 1.0.6), 2.0.13 and 2.1.13.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpg-fips 1.0.13 (from 1.0.6), 2.0.13 and 2.1.13.

Platform affected: Java 8 and later.

When parsing S2K type 4 (Argon2, RFC 9580 §3.7.1.4) from an OpenPGP packet, S2K.Argon2Params reads the one-byte passes, parallelism, and memorySizeExponent fields with only a default cap of memorySizeExponent ≤ 30 (1 TiB). PGPUtil.makeKeyFromPassPhrase feeds these directly into Argon2BytesGenerator via .withMemoryAsKB(1 << memExp).withIterations(passes).withParallelism(parallelism). An attacker controls all three parameters in a tiny SKESK or secret-key packet. A victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen memory allocation (up to ~1 TiB) and CPU work before any authenticity check can occur, yielding OOM or a long hang from a few dozen bytes of input.

The fix was introduced in commit c915cc3f7a8d.