Bouncy Castle bc-java CVE-2026-59644

The target application must import and actively use bc-java's mls module artifact (not merely bc-java's core TLS or crypto APIs) and must process MLS group messages from senders outside full trust. Based on the patch comment, the generation counter is read from authenticated wire data, suggesting the attacker must be a valid MLS group member or be able to inject protocol messages processed before authentication completes - the exact pre/post-auth processing order is not confirmed from available data. Exploitation is blocked in all bc-java deployments that do not use the MLS module. The CVSS PR:N (no privileges) rating conflicts with the 'authenticated from the wire' commentary; until the vendor advisory is reviewed in full, authentication requirements should be treated as unconfirmed. Exploitation is not limited to any specific platform or OS.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H scores 8.7 and signals a straightforward, remotely triggerable DoS with no complexity or privilege barriers per vendor assessment. There is no EPSS data provided and no CISA KEV listing, so real-world exploitation frequency is unconfirmed. CVSS PR:N conflicts with the patch commit commentary, which states the generation counter 'arrives (authenticated) from the wire,' implying the sender must participate in the MLS group protocol - this suggests at minimum PR:L (group membership) may be required, though pre-authentication processing of the field cannot be ruled out without reviewing the full message parsing path. No public POC has been identified. The tags include 'Information Disclosure' (attributed to SUSE), which conflicts with the CVSS VC:N/VI:N/VA:H vector showing availability-only impact; this discrepancy should be verified against the vendor advisory. Real-world blast radius is bounded by MLS adoption: most bc-java deployments use it for TLS or X.509 and are unaffected; only applications integrating the mls artifact and exposing MLS group processing to external senders face genuine risk.

An attacker who is an authenticated MLS group member - or who can inject a crafted MLS wire message prior to authentication verification - sends a message with the generation counter set to 0xFFFFFFFF (maximum 32-bit value). The receiving bc-java instance's GroupKeySet.get() enters a loop performing HKDF derivations for each of approximately 4.29 billion skipped generations, consuming all available CPU until the process is killed or becomes unresponsive. No public exploit code has been identified, but the attack primitive is directly readable from the patch diff and requires no advanced exploitation technique.