CVE-2026-59645: Bouncy Castle DoS Vulnerability

CVE-2026-59645 Overview

CVE-2026-59645 is an uncontrolled recursion vulnerability [CWE-674] in the Bouncy Castle for Java cryptography library. The Octet Encoding Rules (OER) parser recurses without a depth limit when processing self-referential IEEE 1609.2 schemas. A remote attacker can supply a crafted OER-encoded input to trigger unbounded recursion and exhaust stack or heap resources. This results in a denial-of-service condition against any Java application that decodes untrusted OER data using the affected parser.

The issue affects Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) bcutil-fips before 2.0.7 and 2.1.7.

Critical Impact
Remote attackers can crash Java services parsing untrusted IEEE 1609.2 OER data with no authentication or user interaction required.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA) bcutil-fips before 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series)

Discovery Timeline

2026-08-03 - CVE-2026-59645 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-59645

Vulnerability Analysis

The vulnerability resides in the OER decoder implemented in OERInputStream.java. The parser recursively descends into nested schema definitions when decoding IEEE 1609.2 structures. When a schema is self-referential, the decoder invokes itself repeatedly with no upper bound on nesting depth or allocation size. Each recursive call consumes stack frames and heap allocations proportional to the crafted input.

An attacker who can deliver an OER-encoded payload to a Java service using Bouncy Castle can force the JVM to exhaust its stack (StackOverflowError) or heap (OutOfMemoryError). The impact is confined to availability. Confidentiality and integrity are not affected. IEEE 1609.2 is widely used in vehicle-to-everything (V2X) communications, so the parser is commonly reachable from network-facing components in connected-vehicle and telematics deployments.

Root Cause

The OER decoder lacked two safeguards: a maximum nesting depth counter and a bound on cumulative byte allocations during recursive decode. Self-referential schema constructs allowed decode calls to expand without a termination condition tied to depth [CWE-674].

Attack Vector

Exploitation requires only that an attacker submit an OER-encoded blob to an application that decodes it using the affected Bouncy Castle parser. The attack is network-reachable, requires no privileges, and needs no user interaction.

java

// Security patch in OERInputStream.java
// Source: https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989
 private static final int[] bitsR = new int[]{128, 64, 32, 16, 8, 4, 2, 1};
 protected PrintWriter debugOutput = null;
 private int maxByteAllocation = 1024 * 1024;
+ private int maxNestingDepth = 256;
+ private int decodeDepth = 0;
 protected PrintWriter debugStream = null;

The patch introduces maxNestingDepth (default 256) and a decodeDepth counter to enforce a hard ceiling on recursive descent within the OER decoder.

Detection Methods for CVE-2026-59645

Indicators of Compromise

Repeated java.lang.StackOverflowError or java.lang.OutOfMemoryError events originating from org.bouncycastle.oer.OERInputStream in application logs.
Abnormal termination or restarts of Java services that ingest IEEE 1609.2 or other OER-encoded messages.
Sudden spikes in CPU or heap usage tied to incoming OER payloads from a single source.

Detection Strategies

Inventory Java applications and dependencies with SBOM tooling to identify bcprov, bcutil, and bc-fips versions below the fixed releases.
Instrument OER-decoding code paths with size and depth telemetry and alert on payloads that trigger deep recursion.
Correlate JVM crash logs with inbound network traffic to identify malformed OER inputs.

Monitoring Recommendations

Track JVM error rates and heap saturation for services exposing V2X or IEEE 1609.2 endpoints.
Enable web application firewall or gateway logging for oversized or malformed binary payloads sent to OER-handling endpoints.
Monitor process restart frequency for services that parse untrusted OER data.

How to Mitigate CVE-2026-59645

Immediate Actions Required

Upgrade Bouncy Castle for Java to 1.85 or later, LTS to 2.73.12 or later, and BC-FJA bcutil-fips to 2.0.7 or 2.1.7 as applicable.
Audit all applications and services for transitive dependencies on affected Bouncy Castle versions.
Restrict network exposure of endpoints that decode OER or IEEE 1609.2 messages to trusted peers only.

Patch Information

The fix is delivered in commit 822b2478b131097368a56290f5728e28dd042989, which adds maxNestingDepth and a decodeDepth counter to OERInputStream. See the GitHub commit and the Bouncy Castle CVE wiki entry for details.

Workarounds

Reject OER payloads above an application-defined size threshold before they reach the decoder.
Run OER decoding in an isolated worker process with strict JVM heap and stack limits so crashes do not affect the parent service.
Validate schema sources and disallow decoding of OER data from untrusted or unauthenticated peers until patches are applied.

bash

# Maven dependency example - upgrade to fixed version
mvn versions:use-dep-version -Dincludes=org.bouncycastle:bcprov-jdk18on -DdepVersion=1.85 -DforceVersion=true

# Verify installed version
mvn dependency:tree | grep -E 'bcprov|bcutil|bc-fips'