AIKIDO-2026-654199
bcpkix-jdk15to18 is vulnerable to Uncontrolled Resource Consumption
69
CVE Score
Medium
Uncontrolled Resource Consumption
TL;DR
The CMP/CRMF password-based MAC builder derives its MAC key by running a hash-iteration loop whose count is taken directly from the incoming protected message. That count is not bounded, so an externally supplied CMP message can request an arbitrarily large iteration count. Processing such a message forces the library into a very long hashing loop, exhausting processing resources and denying service on the certificate-management endpoint. The fix caps the accepted iteration count and rejects messages that exceed it.
How do I fix this?
Upgrade the org.bouncycastle:bcpkix-jdk15to18 library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Package
Versions
0.0.1 - 1.84
Fixed in 1.85Background info
bcpkix-jdk15to18 is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.84.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.