This vulnerability (CVE-2026-13506) in Legion of the Bouncy Castle Inc.'s BC-JAVA library involves uncontrolled recursion caused by the Lazy ASN.1 sequence forcing mechanism resetting the nesting-depth guard. This flaw affects BC-JAVA versions before 1.85, LTS versions from 2.73.0 up to but not including 2.73.12, and certain FIPS versions prior to 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), and 2.1.3 (2.1.X series). The vulnerability is classified under CWE-674 (Uncontrolled Recursion). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. The vendor has not provided an official remediation level or patch advisory at this time.

The vulnerability allows an attacker to cause uncontrolled recursion in the ASN.1 parsing process, potentially leading to denial of service due to resource exhaustion. The CVSS score of 8.7 reflects a high impact on availability with no required privileges or user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by restricting access to vulnerable components or applying any recommended temporary workarounds from the vendor once published.