CVE catalog
CVE-2026-3505
Allocation of resources without limits or throttling…
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
- Severity
- High · CVSS 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.79% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "bouncycastle",
"status": "fixed",
"release": "sid",
"version": "1.86.2-1"
},
{
"name": "bouncycastle",
"status": "fixed",
"release": "forky",
"version": "1.86-1"
},
{
"name": "bouncycastle",
"status": "vulnerable",
"release": "trixie",
"version": "1.80-3"
},
{
"name": "bouncycastle",
"status": "vulnerable",
"release": "bookworm",
"version": "1.72-2"
}
],
"fixed_versions": [
{
"bug": 1134195,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "1.86-1"
},
{
"bug": 1134195,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "1.86-1"
},
{
"bug": 1134195,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1134195,
"name": "bouncycastle",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "bouncycastle",
"ecosystem": "cpe",
"fixed_version": "not yet fixed"
}
]
}Publisher notes
[trixie] bouncycastle: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libbcjmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbcmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbcpg-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbcpkix-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbcprov-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbctls-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
- [libbcutil-java]Unknown
Source package: [bouncycastle]
Details (2)
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
1.72-2· all · bookwormAffected
nvd · bouncycastle · debian · bookworm; nvd · bouncycastle · debian · 12
[Debian 13 (Trixie)]
- [libbcjmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbcmail-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbcpg-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbcpkix-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbcprov-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbctls-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
- [libbcutil-java]Unknown
Source package: [bouncycastle]
Details (2)
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
1.80-3· all · trixieAffected
nvd · bouncycastle · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:13631]
- [https://access.redhat.com/errata/RHSA-2026:17668]
- [https://access.redhat.com/errata/RHSA-2026:18054]
- [https://access.redhat.com/errata/RHSA-2026:18055]
- [https://access.redhat.com/errata/RHSA-2026:18059]
- [https://access.redhat.com/errata/RHSA-2026:53644]
- [https://access.redhat.com/errata/RHSA-2026:53645]
- [https://access.redhat.com/errata/RHSA-2026:53646]
- [https://access.redhat.com/errata/RHSA-2026:60239]
- [https://access.redhat.com/errata/RHSA-2026:60246]
- [https://access.redhat.com/errata/RHSA-2026:60247]
- [https://access.redhat.com/errata/RHSA-2026:60248]
- [https://access.redhat.com/errata/RHSA-2026:60249]
- [https://access.redhat.com/errata/RHSA-2026:60250]
- [https://access.redhat.com/errata/RHSA-2026:60251]
- [https://access.redhat.com/errata/RHSA-2026:60252]
- [https://access.redhat.com/errata/RHSA-2026:60254]
- [https://access.redhat.com/errata/RHSA-2026:60256]
- [https://access.redhat.com/errata/RHSA-2026:60259]
- [https://access.redhat.com/security/cve/CVE-2026-3505]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2458638]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10571-1.json]
- [https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1]
- [https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-3505]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-3505]
- [https://security-tracker.debian.org/tracker/CVE-2026-3505]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2448.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]