In Bouncy Castle for Java versions prior to 1.86, and certain LTS and FIPS versions before 2.73.13, 1.0.13, 2.0.13, and 2.1.13 respectively, several password-based key derivation entry points did not properly limit cost parameters derived from untrusted input. This lack of bounding allowed an attacker to cause the KDFs to perform an arbitrary amount of work, potentially leading to denial of service via resource exhaustion. Affected components include RFC 9579 PBMAC1 MAC calculator builders, scrypt parallelization parameter p in PKCS#8 and PKCS#12 cost guards, the raw JCA PBKDF2 provider, and bcrypt round counts from encrypted OpenSSH v1 private keys. The issue completes the bounding improvements started in version 1.85 for PKCS#8 / PBES2 decryptors (CVE-2026-15055). The fix involves bounding these parameters before derivation, with the OpenSSH round count now configurable via the org.bouncycastle.openssh.max_rounds property.

The vulnerability allows an attacker to specify unbounded cost parameters for password-based key derivation functions, causing excessive computational resource consumption before password or integrity verification. This can lead to denial of service conditions by exhausting CPU or memory resources. There is no indication of direct compromise or code execution, but the resource exhaustion can disrupt normal operation of applications using the affected Bouncy Castle versions.

Fixed versions are available that properly bound the cost parameters before key derivation. Users should upgrade to Bouncy Castle for Java version 1.86 or later, or to LTS version 2.73.13 or later, or to the specified fixed FIPS versions (1.0.13, 2.0.13, 2.1.13). The OpenSSH bcrypt round count is now configurable via the org.bouncycastle.openssh.max_rounds property. No additional mitigation is required if using these fixed versions.