CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file

August 3, 2026 (updated September 16, 2026)

Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.

References

github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06
github.com/bcgit/bc-java/wiki/CVE-2026-58063
nvd.nist.gov/vuln/detail/CVE-2026-58063

Code Behaviors & Features

Detect and mitigate CVE-2026-58063 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →