In Bouncy Castle for Java prior to version 1.86 and LTS versions before 2.73.13, the raw JCA provider's legacy PBES1 and PKCS#12 PBE families use password-based key derivation with an iteration count taken from untrusted input without bounding it. This allows a crafted small input to dictate an arbitrary amount of work before verification, potentially causing denial of service due to excessive computation. The AlgorithmParameters implementations accepted any count from encoded PKCS12PBEParams or PBEParameter, including values beyond the int range that were narrowed improperly. The vulnerability affects all Cipher, Mac, and SecretKeyFactory operations in these families, including when decrypting PKCS#12 PBE-protected private keys via javax.crypto.EncryptedPrivateKeyInfo.getKeySpec(). The fix enforces rejection of negative or over-limit iteration counts based on the org.bouncycastle.pbe.max_iteration_count property (default 10,000,000) and rejects counts beyond the int range rather than narrowing them.

The vulnerability allows an attacker to supply an iteration count that causes the cryptographic operations to perform an arbitrary and potentially very large amount of computational work before completing. This can lead to denial of service conditions by exhausting CPU resources. There is no indication of confidentiality, integrity, or availability impact beyond resource exhaustion. No known exploits in the wild have been reported.

A fix is available in Bouncy Castle for Java version 1.86 and LTS version 2.73.13 that enforces bounds on the iteration count used in legacy PBES1 and PKCS#12 PBE key derivations. Users should upgrade to these or later versions to mitigate the vulnerability. Until upgraded, users should be aware that untrusted inputs controlling iteration counts can cause excessive computation. Patch status is not explicitly confirmed in the input data but the description states the issue is fixed in these versions. Verify with the vendor advisory for the latest remediation guidance.