CVE-2026-59646 is a memory allocation vulnerability in the DTLS handshake reassembler component of Bouncy Castle for Java. The flaw arises because the buffer size is derived from an unchecked 24-bit length value, potentially causing excessive memory allocation. This issue affects BC-JAVA versions prior to 1.85 and versions in the range >=2.73.0 <2.73.12, as well as specific FIPS series versions before their respective 1.0.24, 2.0.24, and 2.1.24 releases. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with no privileges or user interaction required and no vector complexity. No official remediation level or patch links are provided in the source data.

Successful exploitation could lead to excessive memory allocation during the DTLS handshake process, which may cause denial of service or other memory-related impacts. The vulnerability does not require privileges or user interaction to exploit and is remotely exploitable over the network. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor the vendor's announcements for updates and apply any forthcoming patches promptly. Until a fix is available, consider mitigating exposure by restricting access to affected services or applying any recommended temporary mitigations from the vendor.