Bouncy Castle BC‑JAVA’s bcpg module allocates resource based on unbounded chunk size in PGP AEAD processing, leading to uncontrolled memory consumption without any throttling. An attacker can supply a malicious PGP data file containing large chunk sizes that cause the library to reserve excessive amounts of memory or other system resources before any authentication occurs. This results in resource exhaustion, crashes, or denial of service, aligning with CWE‑400 and CWE‑770.

The vulnerability affects Bouncy Castle BC‑JAVA bcpg implementations from version 1.74 up to but not including 1.80.2, from 1.81 up to but not including 1.81.1, and from 1.82 up to but not including 1.84. Any system that processes PGP data with an affected library version could be impacted.

The CVSS score is 8.7, indicating high severity. The EPSS score of 0.0006 (<1%) suggests a low exploitation probability, although it is not zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted PGP data sent to an application that uses the vulnerable library; the attacker needs only to transmit a malicious file before authentication to trigger the exhaustion. Because memory allocation is unbounded, the impact can range from a local resource drain to a full denial of service against the affected system.