CVE-2026-13586 describes a denial of service vulnerability in Bouncy Castle for Java versions before 1.85, as well as in Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS versions before bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2.1.3 (2.1.X). The issue arises from insufficient bounds on the iteration count used in the PKCS#12 MAC and bag-decryption key derivation function (KDF), which can be exploited to cause excessive resource consumption leading to a denial of service. The vulnerability is classified under CWE-770, indicating improper limitation of resource consumption. There is no vendor advisory or patch information provided in the data.

An attacker can exploit the unbounded iteration count in the PKCS#12 MAC and bag-decryption KDF to cause excessive resource consumption, resulting in a denial of service condition. This could disrupt services relying on the affected Bouncy Castle Java libraries. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider mitigating exposure by limiting access to affected services or components where feasible.