OER parser recurses without depth limit on self-referential IEEE 1609.2 schema
Affects Bouncy Castle for Java FIPS (BC-FJA) bcutil-fips before 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with …