AIKIDO-2026-343055
bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption
69
CVE Score
Medium
Uncontrolled Resource Consumption
TL;DR
Bouncy Castle's OpenPGP Argon2 string-to-key handling honours the memory and pass-count parameters declared in the input without enforcing an upper limit. Processing a crafted message or key can force the library to allocate very large amounts of memory. This can exhaust process resources and deny service. The fix bounds the accepted Argon2 cost parameters.
How do I fix this?
Upgrade the org.bouncycastle:bcpg-jdk18on library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decrypts OpenPGP data protected with an Argon2 string-to-key specifier taken from untrusted input.
Package
Versions
1.71 - 1.84
Fixed in 1.85Background info
bcpg-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 1.71 - 1.84.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.