The vulnerability CVE-2026-59645 in BC-JAVA arises from the OER parser recursively processing a self-referential IEEE 1609.2 schema without any depth limit. This uncontrolled recursion can cause resource exhaustion or application crashes. Affected versions include BC-JAVA before 1.85, LTS before 2.73.12, and BC-FJA FIPS versions prior to 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability.

Successful exploitation of this vulnerability can cause denial of service by exhausting system resources due to uncontrolled recursion in the OER parser. There is no indication of code execution or data breach impacts. The vulnerability affects availability of applications using the vulnerable BC-JAVA versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's announcements for updates and apply patches once available. Until then, consider mitigating exposure by limiting or validating inputs that trigger the OER parser if feasible.