CVE-2026-3505

HighCVSS 7.5

Published: 15/04/2026(UTC)Updated: 09/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

54th percentile - higher than 54% of all known CVEs

Summary

A vulnerability in the BC-JAVA library (pgp modules) causes uncontrolled resource consumption due to missing limits in AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, and OperatorHelper.Java. An attacker can exhaust system resources.

Risk Assessment

The organization is at risk of DoS (Denial of Service) attacks that can disrupt applications using Bouncy Castle for PGP operations.

Recommendation

Immediately update the BC-JAVA library to version 1.80.2, 1.81.1, or 1.84 depending on the branch in use.

Other vulnerabilities in BC-JAVA

CVE-2026-5598High
A covert timing channel vulnerability in the BC-JAVA core library allows an attacker to extract information by measuring the time of cryptographic operations. The issue affects core modules, specifically the FrodoEngine.Java file.

Original NVD description (English source)

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.