CVE-2026-13506 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Organizations using Bouncy Castle for Java in their applications, especially those handling cryptographic operations or ASN.1 encoded data, should be aware of this vulnerability and take steps to mitigate it. This includes developers, security teams, and IT professionals responsible for maintaining and securing software that utilizes Bouncy Castle for Java. Additionally, operators of systems that rely on secure cryptographic operations and ASN.1 processing should review their exposure and implement necessary controls.

Technical summary

The Bouncy Castle for Java library, prior to version 1.85, contains a vulnerability related to the processing of ASN.1 sequences. Specifically, the library does not properly handle nested ASN.1 sequences, which can lead to a denial-of-service (DoS) attack or potentially allow for remote code execution. This issue also affects Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS (BC-FJA) before specific versions depending on the series. The vulnerability stems from inadequate handling of ASN.1 sequence recursion, which can cause a stack overflow or similar issues. Organizations using Bouncy Castle for Java should prioritize updating to a secure version.

Defensive priority

High priority due to CVSS score of 8.7 and potential for nested ASN.1 sequence attacks.

Recommended defensive actions

• Inventory and verify Bouncy Castle for Java versions, checking for 1.85 or later, 2.73.12 or later for LTS, and specific FIPS versions.
• Implement compensating controls such as input validation and ASN.1 encoding checks.
• Monitor for potential exploitation attempts and update detection rules.
• Consider applying patches or updates from Bouncy Castle as a primary remediation step.
• Review and update security policies to include ASN.1 sequence handling best practices.
• Conduct a thorough review of current cryptographic operations and potential exposure.
• Verify that change management processes account for updates to cryptographic libraries.

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Bouncy Castle for Java before version 1.85, affecting ASN.1 sequence processing. The issue allows for potential denial-of-service (DoS) attacks or remote code execution due to improper handling of nested ASN.1 sequences. Organizations should verify their use of affected versions and consider patching or applying compensating controls. Defensive measures include input validation and ASN.1 encoding checks. Evidence limits suggest focusing on version checks and cryptographic operation security.

Official resources