EUVD-2026-91235
GHSA-x7w3-c4mv-whm4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Attacker must be an existing group member sending one network message (AV:N/AC:L/PR:L/UI:N); impact is heap-exhaustion DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (bcorg).
CVSS VectorVendor: bcorg
Lifecycle Timeline
3DescriptionCVE.org
In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.
Articles & Coverage 1
AnalysisAI
Heap-exhaustion denial of service in the MLS implementation of Bouncy Castle for Java (bc-java) before 1.86, triggered by a single small PrivateMessage whose SenderData carries a wire-encoded uint32 leaf_index with its top bit set. Because that value is held in a signed int, it decodes as negative and passes the signed bounds checks in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove, letting a sender outside the tree reach LeafIndex.directPath()/NodeIndex.parent() arithmetic that never terminates at the tree root and grows a node list until the JVM runs out of heap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the target application to use Bouncy Castle's MLS implementation (org.bouncycastle.mls) at a version before 1.86, and (2) the attacker to already be a current member of the MLS group, since the triggering PrivateMessage/SenderData (hasLeaf path) or Remove proposal (validateRemove path) must originate from a group participant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 with impact concentrated entirely in availability (VA:H; VC:N/VI:N), correctly reflecting that this is a pure denial-of-service via JVM heap exhaustion, not a confidentiality or integrity bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Bouncy Castle for Java 1.86 or later, which is the vendor-released fix: the corrective commit (1eb83471eb01727bfdb944a5a46355cc77d55f44) rewrites both bounds checks in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove to use Integer.toUnsignedLong, so out-of-range leaf indices are rejected however they are encoded, and the accompanying GroupKeySetTest regression suite verifies that negative and oversized indices are no longer treated as leaves. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that bundles Bouncy Castle for Java (bc-java) - including transitive dependencies pulled in via Maven or Gradle - and flag anything earlier than 1.86, prioritizing components that actually use the org.bouncycastle.mls package; confirm the version resolved at runtime and enable or verify alerting for OutOfMemoryError and sustained heap growth in those JVMs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-195 – Signed to Unsigned Conversion Error
View allShare
External POC / Exploit Code
Leaving vuln.today