CVE-2026-13505 Overview
CVE-2026-13505 affects Bouncy Castle for Java FIPS (BC-FJA), a widely deployed FIPS 140 validated cryptographic provider. The vulnerability stems from the library's reliance on Object.finalize to zeroise sensitive key material in the AES and DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and the PBKD and scrypt parameter classes. On modern JVMs where finalization is deprecated, the single finalizer thread cannot keep pace with object allocation. The pending-finalization queue grows unbounded, contributing to OutOfMemoryError conditions and leaving key material resident in the heap.
Critical Impact
Applications using BC-FJA on Java 9 or later can experience denial of service through heap exhaustion, while cryptographic key material remains resident in memory instead of being zeroised.
Affected Products
- Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 in the 1.0.X series
- Bouncy Castle for Java FIPS (BC-FJA) before 2.0.2 in the 2.0.X series
- Bouncy Castle for Java FIPS (BC-FJA) before 2.1.3 in the 2.1.X series
Discovery Timeline
- 2026-08-08 - CVE-2026-13505 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-13505
Vulnerability Analysis
BC-FJA overrides Object.finalize on classes that hold sensitive key bytes to overwrite that memory before garbage collection reclaims the object. Finalization is serviced by a single JVM finalizer thread that processes objects at an unspecified time and in an unspecified order. When cryptographic operations allocate finalizable objects faster than the finalizer thread retires them, the pending-finalization queue grows without bound.
Two consequences follow. First, unbounded queue growth pins retained objects in the heap and can drive the JVM into an OutOfMemoryError. Second, the key material inside those queued objects remains readable in memory for the entire time they wait for finalization, defeating the security goal of the zeroisation routine.
This behaviour was tolerable on Java 8 and Java 11, where finalization was still a first-class mechanism. On later JVMs, finalization has been deprecated and progressively de-emphasised, so the finalizer thread is scheduled less aggressively and the backlog forms faster. The classification maps to [CWE-772: Missing Release of Resource after Effective Lifetime].
Root Cause
The root cause is the design choice to bind resource cleanup for sensitive cryptographic state to Object.finalize. Finalization provides no timing or ordering guarantees and cannot scale with allocation rate on modern JVMs.
Attack Vector
An attacker who can drive cryptographic workload against an exposed service, such as TLS handshakes, key derivation calls, or bulk encryption operations, can allocate finalizable BC-FJA objects faster than the finalizer thread drains them. Sustained load pushes the JVM toward heap exhaustion without requiring authentication or user interaction.
The vulnerability manifests inside the finalization pathway of the affected classes. See the GitHub CVE-2026-13505 Documentation for the vendor's technical description.
Detection Methods for CVE-2026-13505
Indicators of Compromise
- OutOfMemoryError events in application logs correlated with elevated cryptographic throughput or TLS handshake volume.
- JVM heap dumps showing a large population of BC-FJA instances such as AES/DESede engine classes, SymmetricSecretKey, or SP 800-90A DRBG state objects queued for finalization.
- Growth in the java.lang.ref.Finalizer reference queue observable through JFR or JMX monitoring.
Detection Strategies
- Inventory Java applications for the bc-fips artifact and record deployed versions to identify hosts below 1.0.2.7, 2.0.2, and 2.1.3.
- Enable Java Flight Recorder or GC logging on services that terminate TLS or perform frequent key derivation to capture finalization backlog trends before an outage.
- Correlate crash dumps and service restarts with cryptographic workload spikes in application performance monitoring.
Monitoring Recommendations
- Alert on repeated OutOfMemoryError conditions in JVMs that load BC-FJA, especially on Java 17 and later.
- Track heap occupancy and Finalizer queue depth on any process that handles high volumes of symmetric encryption or DRBG requests.
- Monitor availability metrics for authentication, TLS termination, and cryptographic microservices for degradation patterns consistent with resource exhaustion.
How to Mitigate CVE-2026-13505
Immediate Actions Required
- Upgrade BC-FJA to bc-fips1.0.2.7, 2.0.2, or 2.1.3 depending on the deployed series. Fixed builds dispatch cleanup through java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay.
- Identify all Java services that bundle vulnerable BC-FJA JARs, including transitive dependencies inside shaded or fat JARs.
- Prioritize remediation on services running Java 9 or later where the finalizer backlog materializes.
Patch Information
The vendor has replaced finalizer-based zeroisation with a Cleaner-based scheme delivered in the multi-release JAR overlay for Java 9 and later. Refer to the GitHub CVE-2026-13505 Documentation for release notes and upgrade guidance. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected because they do not implement the finalizer-based scheme.
Workarounds
- Where an immediate upgrade is not possible, migrate the affected component to Bouncy Castle for Java LTS or standard bcprov if FIPS validation is not required, since neither uses the finalizer-based zeroisation scheme.
- Rate-limit cryptographic operations at the application or gateway layer to reduce allocation pressure on finalizable BC-FJA objects.
- Increase JVM heap sizing as a short-term buffer, understanding that this delays but does not prevent exhaustion under sustained load.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
