Bouncy Castle for Java versions before 1.85 contain a vulnerability in the MLS wire decoder where it allocates memory based on an attacker-controlled opaque length before performing bounds checking. This flaw can lead to resource exhaustion or denial of service. No patch information is currently provided.