CVE-2026-103604 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems that use the bc-csharp library for certificate validation, logging, or display of distinguished names should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-103604 is a denial-of-service vulnerability in the Bouncy Castle bc-csharp library that allows remote attackers to cause CPU exhaustion through specially crafted certificates. Defenders should prioritize patching and assess exposure in systems handling certificate validation.

• Potential CPU exhaustion leading to denial-of-service
• Increased risk of service disruption through exploitation of certificate validation processes
• Need for verification of affected versions and exposure in specific deployment contexts
• Priority on patching or mitigating the vulnerability in systems handling certificate validation

Technical summary

The vulnerability exists in the X509Name.ToString and IetfUtilities.ValueToString methods of the bc-csharp library. These methods inefficiently handle long attribute values that require escaping, leading to quadratic complexity and potential CPU exhaustion. This inefficiency can cause CPU exhaustion through specially crafted certificates, CRLs, certification requests, or other structures with long attribute values that require escaping, impacting systems that use these methods for certificate validation, logging, or display of distinguished names.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that handle certificate validation, logging, or display of distinguished names.

Recommended defensive actions

• Patch bc-csharp library to version 2.7.0 or later
• Implement compensating controls to limit exposure to untrusted certificates
• Monitor systems for unusual CPU usage patterns that may indicate exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by inefficient algorithmic complexity in the X509Name.ToString and IetfUtilities.ValueToString methods. This results in quadratic growth in processing time with the length of the attribute value, leading to potential CPU exhaustion.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.