CVE-2026-13586: Bouncy Castle Java DoS Vulnerability

CVE-2026-13586 Overview

CVE-2026-13586 is a denial-of-service vulnerability in the Bouncy Castle cryptography library for Java. The flaw exists in how PKCS#12 processing enforces bounds on the Key Derivation Function (KDF) iteration count used for MAC verification and bag decryption. An attacker who supplies a crafted PKCS#12 file with an excessive iteration count can force the library into prolonged computation, exhausting CPU resources.

The issue affects Bouncy Castle for Java releases before 1.85, Bouncy Castle for Java LTS before 2.73.12, and multiple Bouncy Castle FIPS (BC-FJA) branches. The weakness is tracked as [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Attackers can trigger sustained CPU exhaustion in any Java service that parses attacker-supplied PKCS#12 keystores or certificate bundles.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA): bc-fips before 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2.1.3 (2.1.X)

Discovery Timeline

2026-08-03 - CVE-2026-13586 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-13586

Vulnerability Analysis

Bouncy Castle's PKCS#12 handling uses a password-based KDF to derive keys for MAC verification and bag decryption. The library reads the iteration count directly from the PKCS#12 structure supplied by the caller. Prior to the fixed releases, no upper bound was enforced on this value.

When an attacker sets the iteration count to an extreme value, the PBE (password-based encryption) routine loops through the hash operation for that many rounds before returning. This blocks the calling thread and consumes CPU cycles. Services that process untrusted keystores, such as TLS mutual-authentication endpoints, certificate import APIs, or code-signing verifiers, become unresponsive.

The EPSS probability is 0.294% at the 21.58 percentile, reflecting a low but measurable exploitation forecast.

Root Cause

The root cause is missing validation of the KDF iteration-count parameter parsed from PKCS#12 MacData and EncryptedContentInfo structures. The library trusted attacker-controlled input to size a computationally expensive loop, matching the [CWE-770] pattern of unbounded resource allocation.

Attack Vector

The attack requires the victim application to load a PKCS#12 file that the attacker controls. This may occur through certificate upload endpoints, keystore import features, or protocols that accept PKCS#12 payloads. No authentication is required when the parsing endpoint is public. User interaction, typically supplying or uploading a file, is required per the CVSS vector.

The vulnerability manifests during MAC verification or bag decryption inside PKCS12KeyStoreSpi. See the GitHub CVE-2026-13586 Details advisory and the upstream fix commit for the specific code paths involved.

Detection Methods for CVE-2026-13586

Indicators of Compromise

Sustained near-100% CPU utilization on JVM threads handling certificate or keystore parsing.
Application timeouts and thread-pool exhaustion correlated with inbound PKCS#12 uploads.
PKCS#12 files where MacData.iterations or PBE iteration counts exceed reasonable thresholds (typically greater than 100,000 rounds).

Detection Strategies

Inspect PKCS#12 files at ingress and reject or quarantine those with iteration counts above a policy-defined ceiling.
Instrument PKCS#12 parsing calls with per-invocation timers and alert on outliers.
Correlate JVM thread dumps showing extended time in PKCS12ParametersGenerator or PBEParametersGenerator with recent input events.

Monitoring Recommendations

Track dependency inventories for bcprov-jdk*, bctls-jdk*, and bc-fips artifact versions across production services.
Monitor HTTP endpoints that accept certificate uploads for anomalous request duration and response latency.
Emit metrics from certificate-import code paths and alert when parse time exceeds a bounded budget.

How to Mitigate CVE-2026-13586

Immediate Actions Required

Upgrade Bouncy Castle to 1.85 or later for the standard Java distribution.
Upgrade Bouncy Castle for Java LTS to 2.73.12 or later.
Upgrade BC-FJA to 1.0.2.7, 2.0.2, or 2.1.3 depending on the deployed series.
Audit third-party libraries and application servers for transitive Bouncy Castle dependencies.

Patch Information

The fix enforces an upper bound on KDF iteration counts read from PKCS#12 structures. The change is available in the update commit and the follow-up fix commit in the bc-java repository. Application owners should redeploy after updating the bcprov and bcpkix artifacts.

Workarounds

Restrict PKCS#12 parsing to trusted, authenticated sources until the library is upgraded.
Enforce a size limit on uploaded PKCS#12 files and pre-scan them for excessive iteration values before passing to Bouncy Castle.
Run PKCS#12 parsing in an isolated thread with a strict CPU time budget and terminate operations that exceed the budget.

bash

# Configuration example: enforce a system-wide PBE iteration ceiling via JVM property
# after upgrading to a fixed Bouncy Castle release
-Dorg.bouncycastle.pkcs12.max_it=200000