The vulnerability (CVE-2026-63566) exists in the DTLS handshake reassembly components (DtlsReliableHandshake, DtlsReassembler) of Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0. The flaw allows a remote unauthenticated attacker to trigger excessive memory allocation by sending crafted handshake message fragments. The reassembly buffer is allocated according to the 24-bit length declared in the fragment header without verifying against the peer's maximum handshake message size, which TLS normally enforces. A fragment with no payload can cause allocation of nearly 16 MB per message, with up to 16 messages pending per handshake, leading to memory exhaustion and denial of service. Both DTLS clients and servers are vulnerable; TLS implementations are not affected.

An unauthenticated remote attacker can cause denial of service by exhausting memory resources during the DTLS handshake process. This can disrupt availability of DTLS clients and servers using vulnerable versions of bc-csharp. There is no indication of confidentiality or integrity impact. The vulnerability does not affect TLS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of DTLS services to untrusted networks or applying network-level protections to mitigate crafted handshake fragments.