Advisory details:
gitlab / maven/org.bouncycastle/bcprov-jdk14/CVE-2026-58063
| Advisory ID | gitlab/maven/org.bouncycastle/bcprov-jdk14/CVE-2026-58063 |
| Aliases |
CVE-2026-58063
|
| Summary | BCFKS keystore load honours unbounded KDF cost from untrusted file Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-jdk14/CVE-2026-58063.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06 | ||
| https://github.com/bcgit/bc-java/wiki/CVE-2026-58063 | ||
| CVE-2026-58063 | https://nvd.nist.gov/vuln/detail/CVE-2026-58063 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.