In Bouncy Castle for Java, the public-key level count for HSS keys is unbounded in versions prior to 1.85, 2.73.12 and 2.0.2/2.1.3. The unbounded count allows an attacker to supply a key that forces the library to allocate a huge amount of memory during verification, leading to resource exhaustion and potential denial of service. The weakness is an instance of uncontrolled resource consumption (CWE‑789).

Affected products include Bouncy Castle for Java (BC‑JAVA) versions before 1.85, Bouncy Castle for Java LTS (BC‑LTS‑JAVA) versions before 2.73.12, and Bouncy Castle for Java FIPS (BC‑FJA) versions before bc‑fips 2.0.2 and 2.1.3. These are used by Java applications that rely on HSS key verification.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, so the exact exploit probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker supplying a malicious HSS public key to an application that performs verification; this can be achieved through certificate validation or any process that accepts external keys. If the verifier runs with full privileges, the allocation can starve the JVM, leading to crashes or severe slowdown. Administrators should assume the vulnerability is exploitable if the library is actively used for key verification.