This vulnerability (CWE-770) in Legion of the Bouncy Castle Inc.'s BC-JAVA library involves the CRMF/CMP password-MAC mechanism accepting an unbounded iteration count, which can cause excessive resource consumption. Affected versions include BC-JAVA before 1.85, LTS versions from 2.73.0 up to but not including 2.73.12, and several BC-FJA FIPS series versions prior to their respective 1.0.12, 2.0.12, and 2.1.12 releases. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

The vulnerability allows an attacker to specify an unbounded iteration count in the password-MAC process, which may lead to excessive resource allocation and potential denial of service due to resource exhaustion. There is no indication of confidentiality or integrity impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions prior to 1.85 and LTS versions before 2.73.12. Users should upgrade to versions 1.85 or later, or LTS 2.73.12 or later once official patches are available. Until patches are confirmed, monitor vendor communications for updates and consider limiting resource allocation where possible in the application environment.