CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). PKMACBuilder’s default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker’s PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies to CMS PasswordRecipientInfo handling.