CVE‐2026‐59645

Title: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema.

Issue affecting: BC before 1.85 (from 1.70), BC-LTS before 2.73.12, BC-FJA before bcutil-fips 2.0.7 and 2.1.7.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcutil-fips 2.0.7 and 2.1.7.

Platform affected: Java 8 and later.

Bouncy Castle's OERInputStream.parse(Element) walks SEQ/CHOICE/Supplier children recursively with no depth counter. The bundled IEEE 1609.2 schema defines a cycle Ieee1609Dot2Data -> Ieee1609Dot2Content(signedData) -> SignedData -> ToBeSignedData -> SignedDataPayload -> Ieee1609Dot2Data via deferred(...).mayRecurse(true), and the mayRecurse flag is only checked by test tooling, not the runtime parser. Public entry points ETSISignedData(byte[]) and ETSIEncryptedData(byte[]) invoke this parser on untrusted bytes before any signature verification. An attacker can craft a ~2-4 KB message with hundreds of nested signedData payloads; each cycle costs ~4-5 input bytes but ~5 Java stack frames, so parsing throws StackOverflowError and crashes the thread/JVM.

The fix was introduced in commit 822b2478b131.

Credit: Alex Gaynor in collaboration with Claude and Anthropic Research.