Bouncy Castle’s BC‑JAVA library processes PGP AEAD packets with an unbounded chunk size, leading to uncontrolled memory allocation before any authentication verification. An attacker can supply a crafted PGP data file that forces the library to reserve large amounts of memory or other system resources, causing resource exhaustion, crashes, or denial of service. This uncontrolled resource consumption reflects CWE‑400 (Uncontrolled Resource Consumption) and the broader Resource Exhaustion weakness CWE‑770.

The vulnerability affects all Bouncy Castle BC‑JAVA bcpg implementations before version 1.84. Any system that processes PGP data with an affected library version could be impacted.

The CVSS score is 8.7, indicating high severity. The EPSS score of 0.00055 (<1%) suggests a low exploitation probability, although it is not zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted PGP data sent to an application that uses the vulnerable library; the attacker needs only to transmit a malicious file before authentication to trigger the exhaustion. Because memory allocation is unbounded, the impact can range from a local resource drain to a full denial of service against the affected system.