Affects Bouncy Castle for Java before 1.85. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, throwing …
Affects Bouncy Castle for Java before 1.85. In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. An attacker with a trusted-key …
Affects Bouncy Castle for Java before 1.85. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext bytes …
Affects Bouncy Castle for Java before 1.85. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of up …
Affects Bouncy Castle for Java before 1.85. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have truncated …
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This issue affects BC-JAVA before 1.84. Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.