In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
CVSS Details
- CVSS 4.0 Base Score: 5.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Azul Zulu | — | Upgrade to Azul Zulu JDK 25 installer 25.35.302 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.51.302 (JDK 21.0.11.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.95.0.302 (JDK 8u503-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.67.302 (JDK 17.0.19.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.89.302 (JDK 11.0.31.0.201+1, quarterly CPU) (LTS stream) | Sep 16, 2026 | Aug 3, 2026 |
| Redhat_linux | — | No solution exists | Aug 26, 2026 | Aug 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub