CVE-2026-103600
HighCVSS 8.7Summary
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via crafted ASN.1 encoding of deeply nested constructed elements (e.g., SEQUENCE inside SEQUENCE), because each nesting level is parsed by a further recursive call with no depth bound. About 2,000 levels (8 KB DER) are enough to exhaust a 1.5 MB thread stack and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process.
Risk Assessment
Any path parsing untrusted ASN.1 data (X.509 certificates, CRLs, CMS/PKCS#7, PKCS#8/PKCS#12, OCSP, TLS Certificate messages) is exposed to a DoS attack leading to process crash. This can paralyze critical services.
Recommendation
Update the Bouncy Castle for .NET (bc-csharp) library to version 2.7.0 or later. The new version introduces a recursion depth limit.
Other vulnerabilities in Bouncy Castle (bc-csharp)
See all- CVE-2026-63570High
A vulnerability in the bc-csharp library (Bouncy Castle for .NET) in Pkcs12Store.GetCertificateChain involves a loop with an unreachable exit condition. An attacker can supply a crafted PKCS#12 file where the certificate chain forms a cycle (e.g., two certificates whose AuthorityKeyIdentifier extensions reference each other's public key), causing the application to hang and exhaust memory until an OutOfMemoryException occurs.
- CVE-2026-103604High
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request, or other structure whose name contains a long attribute value requiring escaping (e.g., commas, leading/trailing spaces), causing quadratic growth in processing time.
- CVE-2026-103603High
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count (L), leading to allocation of an array of size L-1 and memory exhaustion (up to ~17 GB) or OutOfMemoryException.
- CVE-2026-103602High
Improper certificate validation in PkixNameConstraintValidator in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows an attacker who controls or can obtain certificates from a name-constrained intermediate CA to have certificates accepted for email addresses, DNS names, or URI hosts within excluded subtrees, via names ending with a dot (e.g., rfc822Name, dNSName, uniformResourceIdentifier), because comparison does not remove the trailing root-label dot per RFC 1034.
- CVE-2026-103601High
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote attacker to obtain decryptions of chosen ciphertexts via forged messages sent to an application that lets the output buffer of a failed decryption be observed (e.g., through buffer reuse or logging), because decryption writes recovered plaintext into the caller-supplied output buffer before checking the authentication tag and leaves it there on failure.
Original NVD description (English source)
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements (for example SEQUENCE inside SEQUENCE, in definite-length DER or indefinite-length BER form), because each nesting level is parsed by a further recursive call with no bound on depth. About 2,000 levels (8 KB of DER) are enough to exhaust a 1.5 MB thread stack, the .NET main-thread default on Windows, and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process; on threads with larger stacks, parse time instead grows quadratically with depth (about 9 seconds of CPU for a 64 KB input). Any path that parses untrusted ASN.1 is exposed, including X.509 certificates and CRLs, CMS/PKCS#7, PKCS#8/PKCS#12, OCSP and TLS Certificate messages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS