Fluid Attacks Database

Description

Bouncy Castle Uncontrolled Resource Consumption vulnerability Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.bouncycastle:bcpg-jdk15to18	>=0 <1.84	1.84
maven	org.bouncycastle:bcpg-jdk14	>=0 <1.84	1.84
maven	org.bouncycastle:bcpg-jdk12	>=0 <=130	-
maven	org.bouncycastle:bcpg-jdk15	>=0 <=1.46	-
maven	org.bouncycastle:bcpg-jdk15on	>=0 <=1.70	-
maven	org.bouncycastle:bcpg-jdk16	>=0 <=1.46	-
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1 \|\| =1.86.2-1	-
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1 \|\| =1.86.2-1	-
debian 14	bouncycastle	=1.80-3 \|\| >=0 <1.86-1	1.86-1
rpm rhel9	jmc	-	-

1-10 of 11

Aliases

1. CVE-2026-35052. NVD-2026-35053. OSV-2026-35054. OSV-DEBIAN-2026-35055. GCVE-2026-35056. SECURITY-TRACKER-CVE-2026-3505

References

1. https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c12. https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.