Advisories for Maven/Org.bouncycastle/Bcmls-Jdk18on package

Affects Bouncy Castle for Java before 1.85. MLSInputStream.readOpaque() decodes a varint length of up to about 1 GiB and allocates a buffer of that size before confirming enough bytes remain. The call is reached on the first fields of unauthenticated wire structures, ahead of any signature or MAC check. A few bytes declaring a maximal length force a gigabyte allocation per message, and a handful of concurrent messages exhaust the …

Affects Bouncy Castle for Java before 1.85. GroupKeySet.HashRatchet.get() advances the ratchet one generation at a time up to the requested value and caches every intermediate key in an unbounded map. The generation comes from the SenderData of an incoming PrivateMessage, is a 32-bit value encrypted only under the group-shared sender data secret, and is used before any per-message signature check. Any authenticated member can request a maximal generation and force …