CVE-2026-58063

MediumCVSS 5.3/10Last modified Sep 2, 2026

Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Legion of the Bouncy Castle Inc.	BC-JAVA	< 1.85
Legion of the Bouncy Castle Inc.	BC-LTS-JAVA	>= 2.73.0, < 2.73.12
Legion of the Bouncy Castle Inc.	BC-FJA	>= 1.0.0, < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3

References

https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06Patch
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063Third Party Advisory, Patch

Timeline

Published: Aug 3, 2026
Last modified: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580647.5The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a com CVE-2026-580658.1The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verifica CVE-2026-580669.8Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did n CVE-2026-580678.7A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.CVE-2026-580686.8This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.CVE-2026-580698.3This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provide CVE-2026-58077.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generati CVE-2026-580706.8A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to CVE-2026-580718.2A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administ CVE-2026-580729.0A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execu CVE-2026-580739.5A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's CVE-2026-580748.6A vulnerability allowing a high-privileged user to execute arbitrary code on the server.