CVE-2026-13505 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Users of Bouncy Castle for Java FIPS (BC-FJA) versions before bc-fips 1.0.2.7, 2.0.2, and 2.1.3 should be aware of this vulnerability and take steps to mitigate it. This includes assessing usage, applying patches or upgrades, and monitoring for potential issues.

Technical summary

The CVE-2026-13505 vulnerability affects Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), and 2.1.3 (2.1.X series). Sensitive key material held by AES and DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. This could lead to an OutOfMemoryError under load and defeat the purpose of zeroisation. The issue is resolved in later versions and on Java 9 and later, it no longer depends on the finalizer being scheduled.

Defensive priority

This vulnerability has a high CVSS score of 8.7 and is classified as HIGH severity. Affected users should prioritize patching.

Recommended defensive actions

• Inventory and assess usage of affected Bouncy Castle for Java FIPS (BC-FJA) versions
• Apply patches or upgrades to affected BC-FJA versions
• Monitor for potential OutOfMemoryErrors and key material exposure
• Review and update cryptographic key management practices
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-13505 vulnerability affects Bouncy Castle for Java FIPS (BC-FJA) before specific versions. Sensitive key material was zeroised on garbage collection by overriding Object.finalize, but this could lead to an OutOfMemoryError under load and defeat the purpose of zeroisation. The issue is resolved in later versions and on Java 9 and later, it no longer depends on the finalizer being scheduled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.