CVE-2026-3505 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders and administrators using BC-JAVA versions from 1.74 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84 should assess their exposure and take necessary actions.

Why it matters

CVE-2026-3505 is a high-severity vulnerability in BC-JAVA that could lead to denial-of-service attacks due to uncontrolled resource consumption. Defenders should assess exposure, especially in systems using affected BC-JAVA versions, and prioritize patching or mitigating this vulnerability.

• Potential denial-of-service (DoS) attacks due to uncontrolled resource consumption.
• Possible system crashes or instability due to resource exhaustion.
• Need for verification of affected versions and patch application.
• Potential for increased resource utilization, impacting system performance.

Technical summary

The vulnerability is caused by the allocation of resources without limits or throttling and uncontrolled resource consumption in the bcpg module of BC-JAVA. This could lead to a denial-of-service (DoS) attack. A high-severity vulnerability, CVE-2026-3505, was found in the Legion of the Bouncy Castle Inc.'s BC-JAVA, specifically in the bcpg module. This vulnerability affects BC-JAVA versions from 1.74 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84. The vulnerability could lead to a denial-of-service (DoS) attack due to uncontrolled resource consumption.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems using the affected BC-JAVA versions.

Recommended defensive actions

• Assess exposure and apply patches for BC-JAVA versions from 1.74 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84.
• Review and implement resource limits and throttling for the bcpg module.
• Monitor systems for unusual resource consumption patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. Red Hat has also provided errata related to this vulnerability. A high-severity vulnerability, CVE-2026-3505, was found in the Legion of the Bouncy Castle Inc.'s BC-JAVA, specifically in the bcpg module. This vulnerability is related to the allocation of resources without limits or throttling and uncontrolled resource consumption. It affects BC-JAVA versions from 1.74 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84. Defenders should assess

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.