Bouncy Castle’s BC‑JAVA library allows creating PGP AEAD objects without limiting the chunk size that is processed. An attacker can craft an input file with extremely large chunk sizes, forcing the library to allocate memory or other resources before any authentication happens. This uncontrolled allocation can exhaust server memory or swap, leading to denial of service or a crash. The weakness matches CWE‑770 (Resource Exhaustion) and CWE‑400 (Uncontrolled Resource Consumption).

The vulnerability affects all Bouncy Castle BC‑JAVA bcpg implementations before version 1.84. Any system that processes PGP data with an affected library version could be impacted.

The CVSS score is 8.7, indicating high severity. EPSS is not available, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted PGP data sent to an application that uses the vulnerable library; the attacker needs only to transmit a malicious file before authentication to trigger the exhaustion. Because memory allocation is unbounded, the impact can range from a local resource drain to a full denial of service against the affected system.