Bouncy Castle Java CVE-2026-58059

The vulnerable code path in IETFUtils.valueToString() is triggered whenever the application calls X500Name.toString(), .equals(), or .hashCode() on an X500Name instance whose attribute value contains a high density of RFC 4514 special characters (comma ,, double-quote ", backslash \, plus +, equals =, angle brackets < >, semicolon ;) or many leading or trailing ASCII spaces. Exploitation requires that an attacker control the content of at least one RDN attribute in a distinguished name that the application subsequently stringifies - common entry points include TLS client certificate subject/issuer DN processing, LDAP search result parsing, and CSR handling. The CVSS PR:N reflects that in TLS scenarios the certificate is presented and parsed before application-layer authentication occurs. Exploitation is limited to applications that both (1) accept X.500 distinguished names from untrusted sources and (2) invoke any of the three triggering methods on the parsed name; raw-byte certificate relay proxies that never invoke these methods are not exposed. No non-default configuration flag is required - any use of the affected API against attacker-supplied input is sufficient.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H reflects a network-reachable, zero-prerequisite denial-of-service path consistent with scenarios where applications parse attacker-controlled TLS certificates or LDAP-sourced distinguished names. Impact is exclusively availability (VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), meaning there is no risk of data exposure or tampering. No EPSS data was provided in the intelligence sources, and this vulnerability is absent from CISA KEV, so confirmed active exploitation has not been observed. The urgency modifier U:Amber in the CVSS 4.0 vector indicates anticipated targeted rather than widespread exploitation. Real-world exploitability depends critically on whether attacker-controlled X.500 distinguished names reach X500Name.toString() in the application - in network-facing certificate processing this path is plausible without authentication; in purely internal PKI pipelines the exposure is substantially lower. Patch availability reduces urgency further, but the algorithmic nature of the flaw means a single crafted request could stall a CPU thread, making it operationally significant for any Internet-facing Java service performing certificate validation or LDAP directory lookups. Overall, this is a genuine medium-high operational priority for affected environments with network exposure.

An attacker submits a TLS client certificate whose subject distinguished name contains a single RDN attribute value composed of 100,000 comma characters. The target Java application calls X500Name.toString() to log or compare the certificate subject, triggering the O(n²) escaping loop in IETFUtils.valueToString(), which performs approximately 5 billion character-copy operations within a single thread. The thread stalls, consuming a full CPU core; repeated submissions across multiple connections degrade or halt the service. No public exploit code beyond the vendor's own regression test has been identified at time of analysis.