anonhaven
Ad

CVE-2026-3505

HIGH CVSS 4.0: 8.7
Updated Apr 17, 2026
Java
Parameter Value
CVSS 8.7 (HIGH)
Affected Versions before 1.84.
Type CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation Without Limits)
Vendor Java
Public PoC No

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).This issue affects BC-JAVA: before 1.84. Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation Without Limits

References 2

https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1
91579145-5d7b-4cc5-b925-a0262ff19630
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505
91579145-5d7b-4cc5-b925-a0262ff19630
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-33207

Java

8.6

CVE-2026-5598

Java

10.0

CVE-2026-5588

Java

6.3

CVE-2026-0636

Java

5.5

CVE-2025-14813

Java

9.3