CVE‐2026‐14682

Title: Possible OOM from unbounded up-front allocation on a definite-length read.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3, BC-FJA before bctls-fips 1.0.24.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3, BC-FJA bctls-fips 1.0.24.

Platform affected: Java 8 and later.

ASN.1 definite-length parsing allocated the full declared object length up front: DefiniteLengthInputStream.toByteArray() performed a single new byte[length] as soon as the header had been read, so a crafted header of a few bytes arriving over a raw, non-rewindable stream — a TLS record layer or a socket-backed certificate read — could drive a near-heap-sized allocation before a single content byte was consumed (CWE-789). Definite-length objects are now grown incrementally via Streams.readLenBytesFully(), which reads through the stream itself, so an undersized payload fails with the usual "DEF length ... object truncated by ..." message instead of after a full-size allocation.

The fix was introduced in commit 37094e504ef5.

Credit: Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.