CVE-2026-13505: 
Chainguard vulnerability analysis and mitigation

CVE-2026-13505 is a vulnerability in Bouncy Castle for Java FIPS (BC-FJA) where sensitive cryptographic key material is not reliably zeroed from heap memory due to reliance on Java's deprecated Object.finalize() mechanism for zeroisation. The flaw affects BC-FJA versions 1.0.0–1.0.2.6 (1.0.X series), 2.0.0–2.0.1 (2.0.X series), and 2.1.0–2.1.2 (2.1.X series), specifically on Java 9 and later JVMs where finalization has been deprecated and de-emphasized. It was disclosed on August 8, 2026, by Legion of the Bouncy Castle Inc. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, BC-Java Wiki).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). Affected classes — including AES and DESede engines, SP 800-90A DRBGs (HashDRBGWorkingBuffer, HMacDRBGWorkingBuffer, CTRDRBGWorkingBuffer), SymmetricSecretKey, and PBKD/scrypt parameter classes — relied on overriding Object.finalize() to zero out sensitive key material upon garbage collection. Because finalization is serviced by a single JVM thread and runs at an unspecified time and order, under load conditions where finalizable objects are allocated faster than the finalizer thread can retire them, the pending-finalization queue grows unbounded. This causes key material to remain resident in heap memory for an indeterminate period, defeating the purpose of zeroisation, and can also contribute to OutOfMemoryError conditions. The issue is specific to Java 9 and later, where finalization has been progressively deprecated; it was not observed on Java 8 or Java 11 (BC-Java Wiki, GitHub Advisory).

The primary impact is a confidentiality risk: sensitive cryptographic key material (AES keys, DESede keys, DRBG state, symmetric secret keys, and PBKD/scrypt parameters) may remain resident in JVM heap memory for extended, unpredictable periods. An attacker or insider with access to heap dumps or live process memory can potentially recover unzeroized cryptographic keys, undermining the FIPS-mandated prompt-zeroisation requirement. A secondary availability impact exists, as the unbounded growth of the pending-finalization queue under load can contribute to OutOfMemoryError, potentially causing service disruption (BC-Java Wiki, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The CISA SSVC assessment notes exploitation as "none" and technical impact as "partial," though the vulnerability is rated "automatable" (BC-Java Wiki). The EPSS score is approximately 0.253%, placing it in the 17th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the process or a memory/heap dump, limiting the practical attack surface despite the network-accessible CVSS attack vector rating.

Upgrade to the fixed versions of BC-FJA: 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), or 2.1.3 (2.1.X series). The fix replaces the Object.finalize()-based zeroisation with a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, ensuring reliable and timely key material disposal on Java 9 and later without depending on the finalizer thread. As an alternative workaround, organizations may switch to Bouncy Castle for Java (bcprov) or Bouncy Castle for Java LTS, neither of which implements the finalizer-based zeroisation scheme and are therefore unaffected (BC-Java Wiki, GitHub Advisory).

The vulnerability was disclosed directly by Legion of the Bouncy Castle Inc. (assigned CNA bcorg) with a detailed technical wiki page explaining the root cause and fix. The ENISA European Vulnerability Database (EUVD) has catalogued the issue as EUVD-2026-54726. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage.