CVE-2026-3505

What it actually does

Uncontrolled resource consumption in BC-JAVA bcpg pg modules due to missing limits or throttling during AEAD data packet processing in AEADEncDataPacket.java, BcAEADUtil.java, JceAEADUtil.java, and OperatorHelper.java, allowing remote attackers to exhaust memory or CPU.

Why it matters to the business

Attackers can cause denial of service by consuming excessive resources on systems using the affected Bouncy Castle library versions, leading to application unavailability and operational disruption until the service is restarted or resources are freed.

How an attack unfolds

An unauthenticated remote attacker crafts and sends malicious AEAD-encrypted data packets over the network to a target application using vulnerable BC-JAVA bcpg versions; the library allocates unbounded resources while processing the packets in the listed Java files, eventually exhausting memory or CPU and crashing the service.

How to fix it

Upgrade BC-JAVA to version 1.80.2 or later for the 1.74 branch, 1.81.1 or later for the 1.81 branch, and 1.84 or later for the 1.82 branch. Disable or restrict use of the affected pg/AEAD modules until patches are applied if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the Bouncy Castle bcpg JAR version in the classpath matches a fixed release; perform functional testing with known AEAD test vectors to confirm resource usage remains bounded under load; monitor memory and CPU metrics during packet processing.

Typical attack path

1. Identify a network-reachable service that uses BC-JAVA bcpg for OpenPGP or AEAD operations
2. Craft and transmit malformed or specially sized AEAD data packets targeting the vulnerable processing paths
3. Trigger repeated allocation without throttling until resource limits are reached
4. Observe service degradation or crash confirming successful denial of service

How to detect it

Review application logs for sudden spikes in memory or CPU usage correlated with AEAD or PGP packet processing; inspect heap dumps or thread traces for excessive object allocation in the listed Java classes; correlate with network traffic containing unusual AEAD data patterns.

What your security team should do

• Prioritize upgrade of BC-JAVA bcpg to the nearest fixed version in all environments within the next maintenance window
• Inventory all applications and libraries depending on BC-JAVA to determine exposure scope
• Implement network-level rate limiting or input validation on AEAD/PGP endpoints as a temporary control
• Update vulnerability scanning policies to flag any remaining vulnerable bcpg versions