In Bouncy Castle for Java before version 1.86, several password-based key derivation entry points run the KDF with cost parameters taken from untrusted input without bounding them, allowing a small input to dictate an arbitrary amount of computational work before any password or integrity check can reject it. Affected components include the RFC 9579 PBMAC1 MAC calculator builders (JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator), scrypt parallelization parameter p in PKCS#8 and PKCS#12 cost guards, the raw JCA PBKDF2 provider, and bcrypt round count from encrypted OpenSSH v1 private keys. The fix in 1.86 bounds these parameters appropriately, with the OpenSSH round count configurable via the new org.bouncycastle.openssh.max_rounds property. This vulnerability also affects Bouncy Castle for Java LTS before 2.73.13 and Bouncy Castle for Java FIPS before bcpkix-fips 1.0.13, 2.0.13, and 2.1.13. This completes the bounding work started in version 1.85 for PKCS#8 / PBES2 decryptors (CVE-2026-15055).

An attacker can supply crafted input parameters that cause the key derivation functions to consume excessive CPU and memory resources before any password or integrity verification occurs. This can lead to denial of service conditions by exhausting system resources. There is no indication of direct compromise or data leakage from this vulnerability.

Upgrade Bouncy Castle for Java to version 1.86 or later. For Bouncy Castle for Java LTS, upgrade to version 2.73.13 or later. For Bouncy Castle for Java FIPS, upgrade to bcpkix-fips 1.0.13, 2.0.13, or 2.1.13 or later depending on the series in use. These versions implement proper bounding of cost parameters to prevent excessive resource consumption. No other mitigation is required as the issue is fixed in these versions.