CVE-2026-63568 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders and administrators of systems using the Bouncy Castle Inc. bc-csharp library should assess their exposure and take necessary actions to mitigate the vulnerability. This includes verifying the library version, monitoring for unusual patterns of CPU usage, and reviewing system logs for signs of potential attacks. Security teams and vulnerability management teams should prioritize addressing this vulnerability to prevent potential denial-of-service

Why it matters

The vulnerability in the Bouncy Castle Inc. bc-csharp library allows for a denial of service attack through CPU exhaustion. Defenders should prioritize verifying and updating the library to version 2.7.0 or later, and monitor for unusual patterns of CPU usage.

• CPU exhaustion leading to denial of service
• Potential for increased system resource usage
• Need for verification and update of the bc-csharp library

Technical summary

The vulnerability exists in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in the Bouncy Castle Inc. bc-csharp library, allowing a remote unauthenticated attacker to cause a denial of service through CPU exhaustion by sending a CMP message or CRMF certificate request with a PBMParameter declaring a very large iteration count. The PKMacBuilder only enforces its iteration-count ceiling when the caller supplies an explicit maximum through a specific constructor. Defenders should prioritize verifying and updating the bc-csharp library to version 2.7.0 or later.

Defensive priority

Defenders should prioritize verifying and updating the bc-csharp library to version 2.7.0 or later. They should also monitor for unusual patterns of CPU usage that could indicate an ongoing attack.

Recommended defensive actions

• Verify and update the bc-csharp library to version 2.7.0 or later
• Monitor for unusual patterns of CPU usage
• Review system logs for signs of potential attacks
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems
• Review asset inventory for systems using the Bouncy Castle Inc. bc-csharp library
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD vulnerability detail provide information about the vulnerability, its impact, and potential mitigations. The source references include patches and a vendor advisory. Defenders should verify the bc-csharp library version and monitor for unusual patterns of CPU usage. Evidence is limited, and further verification is needed to assess the vulnerability's impact fully.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.