CVE-2026-17507
Description
A flaw was found in Bouncy Castle's Messaging Layer Security (MLS) implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbounded memory allocation during tree path calculations. This flaw exhausts available memory, resulting in a Denial of Service (DoS) for all participants in the group.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Availability
Technical Impact: DoS: Resource Consumption (Other)
in some contexts, a negative value could lead to resource consumption.
Confidentiality,Integrity
Technical Impact: Modify Memory; Read Memory
If a negative value is used to access memory, buffers, or other indexable structures, it could access memory outside the bounds of the buffer.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
