CVE Feed

    Dashboard / CVE / CVE-2026-3505

    CVE-2026-3505

    Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

    Published:Apr 15, 2026
    Last Modified:Aug 27, 2026
    EPS:Apr 15, 2026
    EPSS Score:0.00787
    CVSS Score:7.5

    Affected Products

    Vendor
    Bouncycastle
    Product
    Bc-java

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-13586 (CVSS 5.3) — In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This is…
    CVE-2026-13506 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also…
    CVE-2026-12860 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path.…
    CVE-2026-12852 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bound…
    CVE-2026-12817 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This iss…
    CVE-2026-12816 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This …
    CVE-2026-12803 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce…
    CVE-2026-12802 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This i…
    CVE-2026-14682 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length re…
    CVE-2026-58059 (CVSS 8.7) — In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. Th…

    References

    https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1
    https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505
    https://access.redhat.com/errata/RHSA-2026:13631
    https://access.redhat.com/errata/RHSA-2026:17668
    https://access.redhat.com/errata/RHSA-2026:18054
    https://access.redhat.com/errata/RHSA-2026:18055
    https://access.redhat.com/errata/RHSA-2026:18059
    https://access.redhat.com/errata/RHSA-2026:53644
    https://access.redhat.com/errata/RHSA-2026:53806
    https://access.redhat.com/errata/RHSA-2026:60239
    https://access.redhat.com/errata/RHSA-2026:60246
    https://access.redhat.com/errata/RHSA-2026:60247
    https://access.redhat.com/errata/RHSA-2026:60248
    https://access.redhat.com/errata/RHSA-2026:60249
    https://access.redhat.com/errata/RHSA-2026:60250
    https://access.redhat.com/errata/RHSA-2026:60251
    https://access.redhat.com/errata/RHSA-2026:60252
    https://access.redhat.com/errata/RHSA-2026:60254
    https://access.redhat.com/errata/RHSA-2026:60256
    https://access.redhat.com/errata/RHSA-2026:60259
    https://access.redhat.com/security/cve/CVE-2026-3505
    https://bugzilla.redhat.com/show_bug.cgi?id=2458638
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High