AIKIDO-2026-307106
bcprov-jdk18on is vulnerable to Uncontrolled Resource Consumption
87
High Risk
This Affects:
bcprov-jdk18onTL;DR
HSS/LMS public-key parsing accepts an unbounded level count from the encoded key and allocates structures sized by that count during verify. A crafted public key can force huge allocations. Verifiers that accept untrusted HSS keys are exposed to denial of service. The fix bounds the HSS level count before allocation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify HSS/LMS signatures or parse untrusted HSS public keys.
Background info
bcprov-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 1.65.0 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcprov-jdk18on and/or the org.bouncycastle:bcprov-jdk15to18 library to the patch version.
Links
Fix Commits
github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant