CVE-2026-63570
HighCVSS 7.1Summary
A vulnerability in the bc-csharp library (Bouncy Castle for .NET) in Pkcs12Store.GetCertificateChain involves a loop with an unreachable exit condition. An attacker can supply a crafted PKCS#12 file where the certificate chain forms a cycle (e.g., two certificates whose AuthorityKeyIdentifier extensions reference each other's public key), causing the application to hang and exhaust memory until an OutOfMemoryException occurs.
Risk Assessment
An attacker can cause a denial of service (DoS) in applications processing untrusted PKCS#12 files, leading to hangs and excessive CPU/memory consumption. In production environments, this may result in service unavailability.
Recommendation
Update the Bouncy Castle for .NET (bc-csharp) library to version 2.7.0 or later. If updating is not possible, restrict processing of untrusted PKCS#12 files or apply time and resource limits.
Other vulnerabilities in Bouncy Castle (bc-csharp)
See all- CVE-2026-103604High
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request, or other structure whose name contains a long attribute value requiring escaping (e.g., commas, leading/trailing spaces), causing quadratic growth in processing time.
- CVE-2026-103603High
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count (L), leading to allocation of an array of size L-1 and memory exhaustion (up to ~17 GB) or OutOfMemoryException.
- CVE-2026-103602High
Improper certificate validation in PkixNameConstraintValidator in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows an attacker who controls or can obtain certificates from a name-constrained intermediate CA to have certificates accepted for email addresses, DNS names, or URI hosts within excluded subtrees, via names ending with a dot (e.g., rfc822Name, dNSName, uniformResourceIdentifier), because comparison does not remove the trailing root-label dot per RFC 1034.
- CVE-2026-103601High
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote attacker to obtain decryptions of chosen ciphertexts via forged messages sent to an application that lets the output buffer of a failed decryption be observed (e.g., through buffer reuse or logging), because decryption writes recovered plaintext into the caller-supplied output buffer before checking the authentication tag and leaves it there on failure.
- CVE-2026-103600High
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via crafted ASN.1 encoding of deeply nested constructed elements (e.g., SEQUENCE inside SEQUENCE), because each nesting level is parsed by a further recursive call with no depth bound. About 2,000 levels (8 KB DER) are enough to exhaust a 1.5 MB thread stack and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process.
Original NVD description (English source)
Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificates whose issuer links form a cycle, for example two certificates whose AuthorityKeyIdentifier extensions each identify the other's public key. This happens because the chain-building loop stops only when no issuer is found or a certificate links to itself, and keeps no record of certificates already visited. The key-identifier links are followed without checking signatures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS