Skip to main content

Java CVE-2026-3505

| EUVDEUVD-2026-22855 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-15 bcorg GHSA-cj8j-37rh-8475
Denial Of Service Java Bc Java Legion Of The Bouncy Castle Inc
8.7
CVSS 4.0 · Vendor: bcorg
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious PGP message with unbounded AEAD chunk size
  2. Delivery
    Submit to target service endpoint
  3. Exploit
    Trigger bcpg parser resource allocation
  4. Execution
    Exhaust memory before authentication
  5. Persist
    Crash Java application
  6. Impact
    Deny service to legitimate

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Applications must process PGP messages using the Bouncy Castle bcpg module with AEAD encryption support enabled. The vulnerability triggers when parsing untrusted or externally-sourced OpenPGP content containing AEAD-encrypted packets, which includes scenarios such as email gateways decrypting incoming encrypted messages, file transfer services processing encrypted uploads, messaging platforms handling encrypted chat attachments, or any automated system that decrypts PGP content from unauthenticated sources. No special server configuration, protocol negotiation, or feature flags required beyond standard PGP AEAD processing capability present in default BC-JAVA bcpg deployments.
Impact

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates maximum exploitability: network-accessible, low attack complexity, no prerequisites, no authentication required, and no user interaction. However, real-world risk depends critically on deployment context. The 10.0 score includes high impact to subsequent system security (SC:H/SI:H/SA:H), suggesting potential for pivot attacks beyond simple DoS. EPSS data not provided, but the pre-authentication nature and trivial exploitation requirements elevate practical risk. No CISA KEV listing indicates exploitation is not confirmed in the wild. The absence of public POC code moderates immediate risk, though the technical details in the advisory may enable rapid weaponization. Primary risk manifests as denial-of-service against applications parsing untrusted PGP messages (email gateways, encrypted messaging platforms, file transfer systems). Secondary risk exists if resource exhaustion enables follow-on attacks like authentication bypass via race conditions or memory corruption. Organizations using BC-JAVA for PGP decryption of external content face critical exposure; those using it only for internal signing/verification with trusted inputs have substantially lower risk. This is a genuine priority for public-facing PGP implementations, not merely high-CVSS-low-risk inflation.
Exploit ScenarioDerived

An attacker crafts a malicious PGP AEAD-encrypted message with an excessively large chunk size parameter embedded in the OpenPGP packet headers, then sends this message to a vulnerable email gateway or encrypted file transfer service using BC-JAVA for decryption. Upon receipt, the bcpg module attempts to allocate memory corresponding to the attacker-specified chunk size before performing authentication validation, consuming all available heap memory and causing the Java application to crash or become unresponsive. The attacker requires no credentials or prior access, needing only the ability to submit PGP messages to the target service via SMTP, HTTP upload, or other message ingress channels.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

Pre-authentication resource exhaustion in Bouncy Castle BC-JAVA PGP modules (bcpg) allows remote attackers to trigger denial-of-service by exploiting unbounded AEAD chunk sizes, affecting all versions before 1.84. The maximum CVSS 4.0 score of 10.0 reflects complete compromise potential across confidentiality, integrity, and availability with no attack complexity, no authentication requirements, and network-based exploitation. No public exploit identified at time of analysis, though the attack s

Earlier versions of this analysis (1)
v1 Apr 15, 2026 - 12:39 CVSS 8.7

Pre-authentication resource exhaustion in Bouncy Castle BC-JAVA PGP modules (bcpg) allows remote attackers to trigger denial-of-service by exploiting unbounded AEAD chunk sizes, affecting all versions before 1.84. The maximum CVSS 4.0 score of 10.0 reflects complete compromise potential across confidentiality, integrity, and availability with no attack complexity, no authentication requirements, and network-based exploitation. No public exploit identified at time of analysis, though the attack surface is exposed to unauthenticated remote attackers on default configurations.

RemediationAI

Upgrade to Bouncy Castle BC-JAVA version 1.84 or later immediately, which implements proper validation and throttling of PGP AEAD chunk sizes to prevent resource exhaustion attacks. Update all applications and dependencies that include the bcpg module, verifying the upgrade through dependency management tools (Maven, Gradle) and checking runtime classpath configurations. For environments where immediate upgrade is not feasible, implement network-layer input validation to reject PGP messages exceeding reasonable size thresholds before reaching the bcpg parser, deploy rate limiting on PGP processing endpoints to mitigate mass exploitation attempts, and isolate PGP processing workloads in resource-constrained containers or VMs to contain denial-of-service impact. Consult the official Bouncy Castle advisory at https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505 for additional mitigation guidance and upgrade instructions. Test thoroughly in staging environments before production deployment, particularly for applications with complex PGP workflows or large message volumes.

Affected VersionsENISA

BC-JAVA 0 <1.84

Affected Packages

maven org.bouncycastle:bcpg-jdk12 no fix
maven org.bouncycastle:bcpg-jdk14 fix: 1.84
maven org.bouncycastle:bcpg-jdk15 no fix
maven org.bouncycastle:bcpg-jdk15on no fix
maven org.bouncycastle:bcpg-jdk15to18 fix: 1.84
maven org.bouncycastle:bcpg-jdk16 no fix
maven org.bouncycastle:bcpg-jdk18on fix: 1.84
euvd bc_java fix: 1.84

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 8 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Bouncy Castle BC-JAVA is a widely-deployed cryptographic library for Java applications, providing PGP/OpenPGP implementation through its bcpg module. This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) exists in the PGP Authenticated Encryption with Associated Data (AEAD) implementation. AEAD is a modern cryptographic mode combining confidentiality and authentication, introduced to OpenPGP in RFC 9580. The bcpg module fails to validate or limit chunk sizes in AEAD-encrypted PGP messages during parsing, allowing attackers to specify arbitrarily large chunk sizes. Because this validation failure occurs during message processing before authentication checks, attackers can craft malicious PGP packets that force the parser to allocate excessive memory or CPU resources without valid credentials. The affected CPE (cpe:2.3:a:legion_of_the_bouncy_castle_inc.:bc-java) encompasses all BC-JAVA versions prior to 1.84 across all deployment contexts where the PG modules process untrusted OpenPGP input.

Know when Java gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (bcorg) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (bcorg).

CVSS VectorVendor: bcorg

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
Severity Changed
Apr 15, 2026 - 15:22 NVD
CRITICAL HIGH
CVSS changed
Apr 15, 2026 - 15:22 NVD
10.0 (CRITICAL) 8.7 (HIGH)
Patch released
Apr 15, 2026 - 14:30 nvd
Patch available
CVE Published
Apr 15, 2026 - 09:06 nvd
HIGH 8.7

DescriptionCVE.org

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).This issue affects BC-JAVA: before 1.84.

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Executive ViewAI

Why It Matters

Bouncy Castle bcpg versions before 1.84 contain a critical pre-authentication denial-of-service vulnerability affecting PGP message processing. Any organization using this library for PGP encryption or decryption faces immediate risk of service disruption from remote attackers without requiring credentials. This impacts availability for systems relying on encrypted communications, requiring urgent remediation across development and production environments.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: Implement network-level rate limiting on services exposed to PGP message ingestion; restrict PGP processing to authenticated endpoints only via API gateway rules; disable bcpg PGP functionality entirely if not operationally required until patched version is available; deploy connection timeouts and resource quotas on cryptographic operations to limit exhaustion surface.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3505 ADVISORY https://vuldb.com/vuln/357690 REF https://access.redhat.com/errata/RHSA-2026:13631 REF https://access.redhat.com/errata/RHSA-2026:17668 REF https://access.redhat.com/errata/RHSA-2026:18054 REF https://access.redhat.com/errata/RHSA-2026:18055 REF https://access.redhat.com/errata/RHSA-2026:18059 REF https://access.redhat.com/errata/RHSA-2026:53644 REF https://access.redhat.com/errata/RHSA-2026:53645 REF https://access.redhat.com/errata/RHSA-2026:53646 REF https://access.redhat.com/errata/RHSA-2026:53806 REF https://access.redhat.com/errata/RHSA-2026:60239 REF https://access.redhat.com/errata/RHSA-2026:60246 REF https://access.redhat.com/errata/RHSA-2026:60247 REF https://access.redhat.com/errata/RHSA-2026:60248 REF https://access.redhat.com/errata/RHSA-2026:60249 REF https://access.redhat.com/errata/RHSA-2026:60250 REF https://access.redhat.com/errata/RHSA-2026:60251 REF https://access.redhat.com/errata/RHSA-2026:60252 REF https://access.redhat.com/errata/RHSA-2026:60254 REF https://access.redhat.com/errata/RHSA-2026:60256 REF https://access.redhat.com/errata/RHSA-2026:60259 REF https://access.redhat.com/security/cve/CVE-2026-3505 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458638 REF https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy