The vulnerability CVE-2026-63578 in bc-csharp before 2.7.0 arises from unbounded resource allocation during password-based private-key decryption in the PbeUtilities.GenerateCipherParameters method. The iteration count used in key derivation is extracted from unauthenticated algorithm parameters without an upper limit, enabling an attacker who can supply an encrypted private key (e.g., PKCS#8 EncryptedPrivateKeyInfo or PEM files) to cause CPU exhaustion and denial of service by specifying an iteration count close to 2^31. This affects multiple password-based encryption schemes including PKCS#5 PBES1, PBES2 (PBKDF2), PKCS#12 PBE algorithms, and CMS password recipients. The key derivation process occurs before password or data validation, making early exhaustion possible. Related vulnerabilities in PKCS#12 file handling are addressed separately.

An unauthenticated attacker capable of supplying a crafted encrypted private key can cause a denial of service by exhausting CPU resources. This can disrupt applications using the vulnerable bc-csharp library for password-based private-key decryption. The vulnerability does not involve data compromise or privilege escalation but can degrade service availability.

A fixed version 2.7.0 or later of bc-csharp addresses this issue by imposing limits on iteration counts during key derivation. Users should upgrade to version 2.7.0 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version boundary in the affectedVersions field.