In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. (CVE-2026-59647)

CVE-2026-59647 describes a vulnerability in Bouncy Castle for Java where the CRMF/CMP password-MAC implementation does not properly limit the iteration count, allowing an unbounded number of iterations. This can cause excessive resource consumption, leading to denial of service (CWE-770). The affected products include Bouncy Castle for Java versions prior to 1.85, Bouncy Castle for Java LTS versions prior to 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) versions prior to bcpkix-fips 1.0.12, 2.0.12, and 2.1.12 in their respective series.

The vulnerability can be exploited remotely without authentication and requires no user interaction. It does not impact confidentiality or integrity but can cause availability issues through denial of service by exhausting system resources due to unbounded iteration counts in password-MAC processing.

No explicit patch links are provided in the data, and patch status is not confirmed. Users should check the vendor advisory for the latest remediation guidance and update to Bouncy Castle versions 1.85 or later, 2.73.12 or later for the LTS, and the specified fixed versions for the FIPS series. Until patched, be cautious of untrusted CRMF/CMP password-MAC inputs to avoid potential denial of service.