The vulnerability (CVE-2026-103604) affects the X509Name.ToString and IetfUtilities.ValueToString methods in Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0. The inefficient algorithmic complexity occurs during conversion of X.509 distinguished names containing long attribute values with characters that must be escaped. Each escaping backslash insertion causes the processing workload to grow quadratically with the length of the value, enabling a remote unauthenticated attacker to cause CPU exhaustion and denial of service. This impacts any application that converts such names to strings, including for logging, display, or directoryName name constraint validation in PKIX path validation.

A remote unauthenticated attacker can cause denial of service by exhausting CPU resources when the vulnerable library processes specially crafted X.509 names with long attribute values requiring escaping. This can disrupt applications relying on the bc-csharp library for certificate, CRL, or certification request processing, potentially leading to service outages or degraded performance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing certificates or related structures with unusually long attribute values containing characters that require escaping. Monitor vendor channels for updates and apply official fixes once released.