The vulnerability in Legion of the Bouncy Castle Inc. bc-csharp (before 2.7.0) involves the CMP/CRMF password-based MAC verifier (PKMacBuilder) which does not limit or throttle resource allocation properly. When verifying CMP messages or CRMF certificate requests, if the PBMParameter specifies a very large iteration count, the verifier performs up to approximately 2^31 hash iterations before checking the MAC. This occurs because the iteration-count ceiling is only applied when the PKMacBuilder is instantiated with the constructor that includes an explicit maximum iteration count. Other constructors do not enforce this limit, allowing remote unauthenticated attackers to cause CPU exhaustion and denial of service.

A remote unauthenticated attacker can cause denial of service by sending CMP messages or CRMF certificate requests with very large iteration counts, leading to CPU exhaustion on the affected system. This impacts availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted CMP or CRMF messages with unbounded iteration counts or instantiate PKMacBuilder with explicit iteration count limits if possible.