Threats Tagged 'cve-2026-63575'

A vulnerability in the PKCS#12 key derivation implementation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0 allows an attacker to cause a denial of service via CPU exhaustion. This occurs when a PKCS#12 (PFX) file or PKCS#8 encrypted private key uses a PKCS#12 password-based encryption algorithm with an iteration count of zero or below. The derivation loop runs until its counter equals the count, but for zero or negative counts, it wraps around causing approximately 2^32 iterations, significantly delaying processing.

Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, to cause a denial of service through CPU exhaustion via an iteration count of zero or below, because the derivation loop ran until its counter equalled the count, so for such a count it wrapped through about 2^32 iterations before the MAC or the password could be checked. A 75-byte PFX file with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes.