CVE-2026-97873
Description
A flaw was found in Bouncy Castle. In its legacy password-based encryption implementations, iteration counts parsed from untrusted cryptographic inputs are processed without enforcing an upper limit. A remote attacker could exploit this vulnerability by supplying crafted parameters with an excessively large iteration count, consuming disproportionate processing resources and causing a Denial of Service (DoS).
Statement
A flaw was found in Bouncy Castle's JCA provider when handling legacy PBES1 and PKCS#12 password-based encryption (PBE) parameters. The parameter parser and key derivation implementations accept iteration counts from untrusted cryptographic inputs without enforcing an upper bound. A remote, unauthenticated attacker can supply crafted parameters containing an excessively large iteration count, forcing the system to execute an arbitrary number of derivation cycles before failing verification. This causes disproportionate CPU resource consumption, resulting in a denial of service (DoS).
Mitigation
Configure applications to reject legacy PBES1 and PKCS#12 cipher suites in favor of modern PBKDF2 or Argon2 derivations. Where legacy formats cannot be disabled, restrict network endpoints from accepting untrusted, serialized cryptographic parameters or PKCS#12 containers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
