Skip to content
OpenAdvisories
High · 8.7 CVE-2026-3505 EUVD-2026-22855GHSA-cj8j-37rh-8475

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Published Apr 15, 2026 · Updated Sep 18, 2026 · Assigned by bcorg

Vendor: Legion of the Bouncy Castle Product: BC-JAVA Package: apache-nifi Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: bouncycastle Package: bouncycastle Package: gradle-8 Package: gradle-9 Package: gradle-stage0 Package: jenkins-2-openjdk-21 Package: jenkins-2-openjdk-25 Package: org.bouncycastle:bcpg-jdk12 Package: org.bouncycastle:bcpg-jdk14 Package: org.bouncycastle:bcpg-jdk15 Package: org.bouncycastle:bcpg-jdk15on Package: org.bouncycastle:bcpg-jdk15to18 Package: org.bouncycastle:bcpg-jdk16 Package: org.bouncycastle:bcpg-jdk18on Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).

This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected products

VendorProductAffectedFixed
Legion of the Bouncy Castle BC-JAVA 1.74 – < 1.80.2, 1.81 – < 1.81.1, 1.82 – < 1.84 1.80.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bouncycastle 1.86-1 —
Debian 13 bouncycastle No fix yet —
Debian 12 bouncycastle No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 bouncycastle No fix yet —
Ubuntu 26.04 LTS bouncycastle No fix yet —
Ubuntu 25.10 bouncycastle No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS bouncycastle No fix yet —
Ubuntu Pro 22.04 LTS bouncycastle No fix yet —
Ubuntu Pro 20.04 LTS bouncycastle No fix yet —
Ubuntu Pro 18.04 LTS bouncycastle No fix yet —
Ubuntu Pro 16.04 LTS bouncycastle No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.20-1.redhat_00001.1.el7sso RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-22.redhat_00057.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-glassfish-jsf 2.3.14-11.SP11_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-ironjacamar +8 1.5.26-2.Final_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.8-1.redhat_00003.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-remoting 5.0.31-3.SP2_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-server-migration +2 1.10.0-46.Final_redhat_00044.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.135-1.Final_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-api +7 2.5.5-24.SP12_redhat_00016.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-bindings +1 2.5.5-30.SP12_redhat_00020.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.25-2.GA_redhat_00001.1.el7eap RHSA-2026:53644
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.40.0-6.redhat_00012.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-angus +1 2.0.5-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.1.7-1.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.5-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.84.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.7-1.redhat_00002.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.6.0-1.GA_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-3.jre_redhat_00004.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.3-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hal-console 3.7.19-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-hibernate +2 6.6.48-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-hibernate-search +6 7.2.6-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-5.redhat_00008.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.22-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.18.9-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jakarta-activation 2.1.4-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.5-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.7-4.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jaxbintros 2.1.0-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-logging 3.6.2-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jboss-remoting 5.0.31-1.SP2_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-api 3.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-common-tools 2.2.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.4.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-jaxws-undertow-httpspi 3.0.1-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jbossws-spi 5.1.0-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.6-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.11-2.SP1_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-log4j 2.25.4-1.redhat_00003.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-neethi 3.2.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-netty +14 4.1.132-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.4-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-parsson 1.1.9-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-plexus-utils 3.6.1-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.12-1.redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-reactivex-rxjava2 2.2.21-5.redhat_00003.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-saaj-impl +1 3.0.6-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.18-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-undertow 2.3.26-2.SP3_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.6-5.GA_redhat_00007.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-client-config 1.0.1-4.Final_redhat_00002.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.6.11-1.Final_redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-http-client +4 2.1.4-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-javadocs 8.1.1-10.GA_redhat_00017.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-wildfly-openssl +1 2.3.0-1.Final_redhat_00001.1.el8eap RHSA-2026:18055, RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el8-x86_64 2.3.0-1.Final.redhat.00001.1.el8eap RHSA-2026:18054
Red Hat JBoss EAP 8 eap8-wildfly-openssl-el9-x86_64 2.3.0-1.Final_redhat_00001.1.el9eap RHSA-2026:18055
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.2-1.redhat_00001.1.el8eap RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228
Red Hat JBoss EAP 8 eap8-yasson 3.0.4-5.redhat_00007.1.el8eap RHSA-2026:18055, RHSA-2026:18054

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bouncycastle 1.84-1.1 openSUSE-SU-2026:10571-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-nifi 2.9.0-r1 —
Wolfi rolling apache-nifi-registry +1 2.9.0-r2 —
Wolfi rolling gradle-8 8.14.4-r4 —
Wolfi rolling gradle-9 9.4.1-r2 —
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling jenkins-2-openjdk-21 +1 2.560-r0 —
Wolfi rolling wildfly-openjdk-17 +1 39.0.1-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bcpg-jdk12 <= 130 — GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk14 < 1.84 1.84 GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk15 <= 1.46 — GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk15on <= 1.70 — GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk15to18 < 1.84 1.84 GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk16 <= 1.46 — GHSA-cj8j-37rh-8475
Maven org.bouncycastle:bcpg-jdk18on < 1.84 1.84 GHSA-cj8j-37rh-8475

Advisories 14

References