Threats tagged 'ghsa-jmxg-924w-f7mv'

Bouncy Castle for Java versions prior to 1.85 and certain LTS and FIPS versions improperly honor an unbounded key derivation function (KDF) cost parameter from untrusted BCFKS keystore files during load. This vulnerability could lead to resource exhaustion or denial of service due to excessive computational cost. The issue affects Bouncy Castle for Java, including LTS versions before 2.73.12 and FIPS versions before bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2.1.3 (2.1.X). No known exploits are reported in the wild. The severity is assessed as medium based on available data.