CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as a truncation error instead.