CVE-2026-59649
Description
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.
Statement
Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OpenPGP user-attribute subpacket length is bounded only by the JVM maximum memory, so processing a specially crafted OpenPGP message causes excessive memory consumption and a denial of service. This is reachable only via the OpenPGP (bcpg) code paths; products that do not parse untrusted OpenPGP messages are not exposed.
Mitigation
Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
