The vulnerability CVE-2026-59644 affects BC-JAVA versions 1.73 up to but not including 1.85. The MLS hash-ratchet component improperly honors an arbitrary 32-bit generation counter provided by the sender, which can cause excessive iteration. This behavior can lead to resource exhaustion or denial of service conditions. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on availability.

An attacker can exploit this vulnerability remotely without authentication or user interaction to cause high impact on system availability by forcing excessive iteration in the MLS hash-ratchet. This could lead to denial of service or resource exhaustion in affected applications using BC-JAVA versions prior to 1.85.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor the vendor's communications for updates and apply patches once available.