This vulnerability causes sensitive key material stored in AES and DESede engines, DRBGs, SymmetricSecretKey, and certain parameter classes to remain in the Java heap longer than intended when objects are collected by finalization. The key data is only wiped when the finalizer runs, but the finalizer runs on a single thread at an unspecified time. Under heavy load the finalization queue can grow without bound, leading to delayed zeroisation and a higher chance of an OutOfMemoryError. The result is that secret material can persist in memory for an arbitrary period, reducing its confidentiality protection.

Legion of the Bouncy Castle Inc. provides the Bouncy Castle FIPS for Java (BC-FJA) library. Versions before bc-fips 1.0.2.7 (for the 1.0.X series), before 2.0.2 (2.0.X series) and before 2.1.3 (2.1.X series) are affected. The standard Bouncy Castle provider (bcprov) and the LTS releases are not impacted.

The CVSS score of 8.7 indicates a high severity flaw. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. However, the flaw can be triggered by any code that creates a large number of key‑related objects under load, making it potentially exploitable in high‑traffic or embedded Java environments. The likely attack vector is the normal use of the affected library under high load, as the finalizer queue grows when many key objects are created, delaying zeroisation and potentially exhausting memory. The risk is highest in environments where sensitive keys are frequently generated and the Java runtime contends with limited heap space.