The vulnerability CVE-2026-59647 in Legion of the Bouncy Castle Inc.'s BC-JAVA library involves the CRMF/CMP password-MAC component honoring an unbounded iteration count. This lack of limits on iteration count can cause excessive resource consumption. Affected versions include Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS versions from 2.73.0 up to 2.73.12, and certain BC-FJA versions prior to specified patch levels. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

The vulnerability allows an attacker to cause resource exhaustion by specifying an unbounded iteration count in the CRMF/CMP password-MAC process. This can degrade service availability or cause denial of service conditions. There is no indication of privilege escalation or data compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary fix is explicitly stated in the provided data. Users should monitor the vendor's advisories for updates and apply patches once available. Until then, consider limiting iteration counts or applying application-level throttling if feasible.