The vulnerability arises from the ASN.1 parser in bc-csharp versions prior to 2.7.0, which uses recursive calls to parse nested ASN.1 constructed elements without limiting recursion depth. Approximately 2,000 nested levels (about 8 KB of DER data) can exhaust the default 1.5 MB thread stack on Windows, causing a StackOverflowException that terminates the process. On threads with larger stacks, parsing time increases quadratically with nesting depth, significantly degrading performance. This flaw allows remote unauthenticated attackers to trigger denial of service by supplying malicious ASN.1 data in various protocols and formats that rely on ASN.1 parsing.

Successful exploitation results in denial of service due to stack exhaustion and process termination via a StackOverflowException in the .NET runtime. This affects any application using vulnerable versions of bc-csharp to parse untrusted ASN.1 data, potentially disrupting services that handle certificates, cryptographic messages, and related protocols. There is no indication of code execution or data disclosure from this vulnerability.

A fixed version 2.7.0 of bc-csharp is available that addresses this uncontrolled recursion issue. Users should upgrade to version 2.7.0 or later to remediate this vulnerability. No other vendor advisory content is provided, so patching is the primary recommended mitigation.