AIKIDO-2026-398185
bcpkix-jdk15to18 is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
bcpkix-jdk15to18TL;DR
The PKCS#8 and PBES2 input decryptor builders take key-derivation cost parameters from the encrypted private-key material being parsed. These Key Derivation Function (KDF) cost values are not capped, so a crafted encrypted PKCS#8 key can declare an arbitrarily expensive derivation. Decrypting such input drives the key-derivation function through an excessive amount of work, leading to Denial of Service. The fix bounds the accepted KDF cost so oversized parameters are rejected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decrypts PKCS#8 or PBES2-encrypted private keys supplied from untrusted sources.
Background info
bcpkix-jdk15to18 is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcpkix-jdk15to18 library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant