Technical impact
In Bouncy Castle for Java before version 1.85, the PKCS#8 and PBES2 decryptors honor a key‑derivation‑function (KDF) cost parameter supplied by the input data, and this cost value can be unbounded. The vulnerability matches CWE‑770, Uncontrolled Resource Consumption. An attacker can embed an excessively large cost in a key file, causing the library to perform a proportionally higher number of computational iterations during decryption. The resulting CPU exhaustion can make the application or service that uses the decryptor unresponsive or crash, producing a denial‑of‑service for users of the affected libraries.
Affected Systems
The flaw affects Bouncy Castle for Java (BC-JAVA) prior to release 1.85, Bouncy Castle for Java LTS (BC-LTS-JAVA) before version 2.73.12, and Bouncy Castle for Java FIPS (BC‑FJA) prior to bcpkix‑fips 1.0.12, 2.0.12, or 2.1.12. Applications that rely on these libraries to process PKCS#8 or PBES2 key files are susceptible.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting no documented widespread exploits. The vulnerability is not listed in CISA KEV. The likely attack vector involves an attacker supplying a crafted key file containing an aggressively high KDF cost to the decryptor, forcing the library to carry out many iterations of the KDF. Because the cost can be unbounded, an application that does not enforce a maximum value can become overwhelmed, resulting in CPU exhaustion or an abrupt denial of service. No publicly documented exploits currently exist.
