CVE-2026-59647: Bouncy Castle Java DoS Vulnerability

CVE-2026-59647 Overview

CVE-2026-59647 affects Bouncy Castle for Java, a widely deployed cryptographic library. The vulnerability resides in the CRMF/CMP password-based Message Authentication Code (MAC) implementation, which honours an unbounded iteration count supplied through the unauthenticated PBMParameter field of incoming CMP messages. An attacker can send a crafted message with an extremely large iteration count, forcing the server to perform an iterated hash operation that exhausts CPU resources. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated network attackers can trigger CPU exhaustion by submitting CMP messages with excessive iteration counts, degrading availability of services that rely on Bouncy Castle's PKMAC verification.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12, 2.0.12, and 2.1.12

Discovery Timeline

2026-08-03 - CVE-2026-59647 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-59647

Vulnerability Analysis

The vulnerability exists in Bouncy Castle's implementation of RFC 4211 Public Key MAC (PKMAC) verification used in Certificate Management Protocol (CMP) exchanges. The PKMACBuilder class processes the iteration count carried inside the PBMParameter structure of incoming CMP messages. This iteration count drives an iterated hash computation used to derive the MAC key.

Because the PBMParameter is not authenticated before verification begins, an attacker can specify an arbitrarily large iteration count. Bouncy Castle historically did not enforce an upper bound on this value. Verifying an attacker-controlled message therefore becomes a CPU-exhaustion vector, since the receiver must complete the full iterated hash before authentication can fail.

Root Cause

The root cause is missing input validation on the iteration count field. The library dereferenced the attacker-supplied value directly, without comparing it against a sane upper bound. This falls under CWE-770, the absence of resource throttling.

Attack Vector

The attack requires no authentication, no user interaction, and is exploitable over the network. Any service that accepts and verifies CMP messages using Bouncy Castle's PKMACBuilder is exposed. A single small message can trigger sustained CPU work, and repeated messages can produce a denial-of-service condition against certificate authorities, registration authorities, or other CMP endpoints.

java

// Security patch: core/src/main/java/org/bouncycastle/util/Properties.java
public static final String PBE_MAX_SCRYPT_MEMORY = "org.bouncycastle.pbe.max_scrypt_memory";

/**
 * Upper bound on the RFC 4211 PKMAC / CMP password-based-MAC iteration count honoured when no
 * explicit ceiling was supplied to {@link org.bouncycastle.cert.crmf.PKMACBuilder}. The count
 * travels in the (unauthenticated) PBMParameter of an incoming CMP message and drives an
 * iterated hash, so an unbounded count makes verifying an attacker-supplied message a
 * CPU-exhaustion vector. Default 10,000,000, generous enough for any legitimate setting. Read
 * via {@link #asInteger(String, int)}.
 */
public static final String PKMAC_MAX_ITERATION_COUNT = "org.bouncycastle.pkmac.max_iteration_count";

Source: Bouncy Castle patch commit c99d6427. The patch introduces a configurable ceiling (default 10,000,000) enforced during PKMAC verification.

Detection Methods for CVE-2026-59647

Indicators of Compromise

Sustained high CPU utilisation on Java processes hosting CMP or CRMF endpoints without a corresponding rise in legitimate request volume.
CMP messages containing PBMParameter structures with iteration counts substantially higher than 10,000,000.
Repeated inbound connections from a small set of source addresses targeting CMP listener ports.

Detection Strategies

Inspect network telemetry for CMP traffic and parse PBMParameter fields to flag messages with abnormally large iteration counts.
Monitor Java thread dumps or profiling data for extended time spent in PKMACBuilder and related MAC computation stack frames.
Correlate application logs from CMP endpoints with CPU saturation events on the hosting Java Virtual Machine (JVM).

Monitoring Recommendations

Alert on bcpkix or bcprov versions below the fixed releases through software composition analysis in continuous integration pipelines.
Track CMP request latency distributions and alert when tail latencies grow without a corresponding traffic increase.
Log the resolved value of the org.bouncycastle.pkmac.max_iteration_count system property at application startup to confirm enforcement.

How to Mitigate CVE-2026-59647

Immediate Actions Required

Upgrade Bouncy Castle for Java to 1.85 or later, LTS to 2.73.12 or later, or the applicable FIPS release (1.0.12, 2.0.12, or 2.1.12).
Inventory all Java applications that use org.bouncycastle.cert.crmf.PKMACBuilder or process CMP messages, including transitive dependencies.
Restrict network exposure of CMP endpoints to trusted sources until patched builds are deployed.

Patch Information

The fix is delivered in the GitHub commit c99d6427. It adds a bounded default iteration count of 10,000,000 to PKMACBuilder and exposes the ceiling through the org.bouncycastle.pkmac.max_iteration_count system property. See the Bouncy Castle CVE-2026-59647 wiki entry for vendor guidance.

Workarounds

Set an explicit iteration-count ceiling by calling PKMACBuilder.setIterationCount(...) on any custom builder instances before verification.
Front CMP endpoints with a proxy or application firewall that inspects and rejects messages containing oversized PBMParameter iteration counts.
Apply per-source rate limiting on CMP listener ports to reduce the impact of repeated exploitation attempts.

bash

# Enforce the bounded iteration count via JVM system property
java -Dorg.bouncycastle.pkmac.max_iteration_count=10000000 \
     -jar your-cmp-service.jar