Bouncy Castle Java CVE-2026-13506

Exploitation requires that the application uses Bouncy Castle in lazy ASN.1 parsing mode (ASN1InputStream instantiated with lazyEvaluate=true) and subsequently performs a full tree traversal of the parsed object - such as calling hashCode(), equals(), re-encoding, or iterating via getObjects(). This lazy mode is commonly used internally by Bouncy Castle when processing large ASN.1 structures for performance. The crafted input must contain more nested SEQUENCE levels than the configured depth limit (default 64) to trigger the guard bypass. Applications that parse ASN.1 eagerly (lazyEvaluate=false) are not vulnerable to this specific flaw. No authentication is required when the affected ASN.1 parsing endpoint is network-facing (e.g., TLS certificate processing, CMS verification APIs). Exploitation is limited to availability impact - a StackOverflowError - with no confidentiality or integrity consequence confirmed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a low-complexity, unauthenticated, network-reachable denial-of-service with no confidentiality or integrity component. Real-world risk is moderate-to-high for applications that process untrusted ASN.1 data - TLS handshake certificate chains, OCSP responses, signed CMS/PKCS#7 messages, or any protocol that submits ASN.1 to Bouncy Castle - because the attack requires no special authentication and the input vector is commonly exposed at network boundaries. Applications that pass only internally generated ASN.1 to Bouncy Castle have substantially reduced exposure. The 'Information Disclosure' tag present in the source metadata is inconsistent with the CVSS vector (VC:N/VI:N/VA:H) and appears to be a tagging error; no confidentiality impact is indicated by the authoritative CVSS assessment. No EPSS score was supplied and CISA KEV status is unconfirmed, so exploitation likelihood must be inferred from the vulnerability class: ASN.1 parsing DoS flaws in widely deployed cryptographic libraries have historically attracted exploit development.

An attacker submits a crafted X.509 certificate or CMS-signed message containing 256 or more nested SEQUENCE elements to a server that uses Bouncy Castle for TLS certificate validation or signature verification. The initial lazy parse at the network layer succeeds because only the outermost level is decoded eagerly. When the application subsequently validates the certificate chain or computes a signature, Bouncy Castle traverses the full ASN.1 tree, and each LazyEncodedSequence.force() call resets the depth guard, recursing deeper until a StackOverflowError crashes the certificate-processing thread or the entire JVM process. The vendor's regression test (testHeavilyLazyNestedSequence in ASN1SequenceParserTest.java) demonstrates that 256 levels of nesting reliably reproduces the condition.