CVE-2026-97873: 
Bouncy Castle vulnerability analysis and mitigation

CVE-2026-97873 is a Denial of Service vulnerability in Bouncy Castle for Java caused by unbounded iteration counts in legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE password-based key derivation functions. Affected products are bcprov (all versions before 1.86) and bcprov-lts8on (versions 2.73.0 through before 2.73.13) by Legion of the Bouncy Castle Inc. The vulnerability was published on October 3, 2026, with a patch available in the same release cycle. It carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, BC-Java Wiki).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the AlgorithmParameters implementations for PKCS12PBE (and its OID aliases such as pbeWithSHAAnd3-KeyTripleDES-CBC) and PBKDF1 accepted any iteration count from an encoded PKCS12PBEParams or PBEParameter without validation, and narrowed values beyond the int range using intValue() (causing a wire count of 2^32 to arrive as 0). Every Cipher, Mac, and SecretKeyFactory in these families then derived keys using whatever count was supplied, including counts decoded by a third-party provider — for example, when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec(key, "BC") decrypts a PKCS#12 PBE-protected private key, the JDK's own provider decodes the parameters and passes only the resulting PBEParameterSpec to BC's Cipher, bypassing any parameter-parser bound. Because these schemes are unauthenticated, no verification occurs before the expensive derivation: a 52-byte encrypted key carrying the maximum iteration count held a single getKeySpec call for approximately 20 minutes of CPU. The fix (commit 766a310) applies the existing org.bouncycastle.pbe.max_iteration_count property (default 10,000,000) — already used for PBKDF2 (CVE-2026-17508) — to both the parameter parse and the derivation engine, and additionally rejects counts beyond the int range rather than narrowing them (BC-Java Wiki, Fix Commit).

Successful exploitation causes excessive CPU consumption on the server processing the crafted input, potentially blocking the affected thread indefinitely and denying service to legitimate users attempting to decrypt PBE-protected keys or data. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Any application using Bouncy Castle's raw JCA provider to process externally supplied PKCS#12 or PBES1-encrypted structures (e.g., private key decryption via EncryptedPrivateKeyInfo.getKeySpec) is at risk, and a single small crafted input (~52 bytes) can monopolize CPU for extended periods (BC-Java Wiki, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires passive user interaction (a user or service must process the attacker-supplied encoded structure), but no authentication or privileges are required, making it accessible to unauthenticated network attackers in scenarios where the application accepts externally supplied cryptographic objects.

1. Identify a target: Locate an application that uses Bouncy Castle for Java (bcprov < 1.86 or bcprov-lts8on < 2.73.13) to process externally supplied PKCS#12 or PBES1-encrypted structures, such as a service that accepts user-uploaded private keys or certificates for decryption.
2. Craft a malicious encoded structure: Construct a minimal PKCS#12 PBE-encrypted object (e.g., a PKCS#12 bag or PBES1-encrypted private key, as small as ~52 bytes) with an arbitrarily large iteration count embedded in the PKCS12PBEParams or PBEParameter ASN.1 structure — for example, setting the iteration count to Integer.MAX_VALUE (2,147,483,647) or a value exceeding the int range to trigger the intValue() narrowing bug.
3. Submit the crafted input: Send the malicious encoded structure to the target application via the relevant interface (e.g., file upload, API endpoint, TLS client certificate, or any code path invoking javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() or a BC Cipher/SecretKeyFactory with PKCS12PBE/PBES1 parameters).
4. Trigger unbounded key derivation: The BC provider parses the iteration count without bounds checking and begins the password-based key derivation (PBKDF1 or PKCS12 KDF), consuming CPU proportional to the supplied count — potentially blocking the processing thread for minutes to hours.
5. Achieve denial of service: By repeatedly submitting such crafted inputs, the attacker exhausts server CPU resources, preventing legitimate users from completing decryption operations and effectively denying service (BC-Java Wiki, GitHub Advisory).

• Process: Java processes consuming sustained, near-100% CPU on a single thread for extended periods (minutes or longer) without completing a cryptographic operation; thread dumps showing threads blocked inside Bouncy Castle PBKDF1 or PKCS12 key derivation methods (e.g., org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2, org.bouncycastle.crypto.generators.PKCS12ParametersGenerator).
• Logs: Application logs showing repeated or long-running decryption requests involving PKCS#12 or PBES1-protected structures; errors or timeouts on operations involving EncryptedPrivateKeyInfo.getKeySpec() or BC Cipher decryption with PBE algorithms.
• Network: Unusual or repeated submissions of small PKCS#12 or PEM-encoded private key files to endpoints that perform server-side decryption; network traffic containing ASN.1-encoded structures with anomalously large integer values in the iteration count field.

Upgrade Bouncy Castle for Java to version 1.86 or later (artifact bcprov), or to bcprov-lts8on 2.73.13 or later for the LTS variant. As a configuration-based mitigation or defense-in-depth measure, set the JVM system property org.bouncycastle.pbe.max_iteration_count to an appropriate upper bound (the default in patched versions is 10,000,000); note that deployments that previously raised org.bouncycastle.pkcs12.max_it_count above 10,000,000 must also raise org.bouncycastle.pbe.max_iteration_count to match. The PKCS#8 decryptors in the PKIX API (JcePKCSPBEInputDecryptorProviderBuilder) and the provider's PKCS#12 key store were already bounded and are not affected (BC-Java Wiki, Fix Commit).

The vulnerability was credited to researcher Arpan Sharma and disclosed by the Bouncy Castle maintainers (David Hook) via the project's GitHub wiki on October 3, 2026. No significant broader media coverage or notable community commentary beyond the official advisory and standard vulnerability database aggregation has been observed at this time (BC-Java Wiki).