CVE-2026-58063

Published: Ago 03, 2026 Last Modified: Ago 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: 91579145-5d7b-4cc5-b925-a0262ff19630
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

770

Allocation of Resources Without Limits or Throttling

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f8…
https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%8…
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063