VULNERABILITY INTELLIGENCE

CVE-2026-58063

CVSS score5.3 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-08-03
Last modified2026-09-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Weakness classification

  • 91579145-5d7b-4cc5-b925-a0262ff19630: CWE-770

Primary references