AIKIDO-2026-62304
bcprov-jdk18on is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
bcprov-jdk18onTL;DR
The PKCS#12 keystore implementation in the Bouncy Castle JCE provider honours the MAC and bag-decryption key-derivation iteration count declared in an input file without an effective upper bound. Loading a crafted PKCS#12 keystore that declares an extremely large iteration count forces excessive key-derivation work. Before the fix, parsing untrusted PKCS#12 data can drive uncontrolled resource consumption. The fix validates and bounds the accepted iteration count during keystore load and bag decryption
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load PKCS#12 files from untrusted sources.
Background info
bcprov-jdk18on is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcprov-jdk18on library to the patch version.
Links
Fix Commits
github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant