CVE-2026-63570 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems using bc-csharp before 2.7.0 should assess exposure and prioritize verification and remediation efforts. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring system availability and performance. They should verify the bc-csharp version used in their systems, review the vulnerability details, and plan for updates or mitig

Why it matters

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using bc-csharp before 2.7.0, as it can cause a denial of service and potential OutOfMemoryException.

• Denial of service due to infinite loop and resource consumption
• Potential for OutOfMemoryException
• Need for verification of bc-csharp version and exposure
• Possible impact on system availability and performance

Technical summary

The vulnerability exists in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0. An attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain can cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificates whose issuer links form a cycle.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using bc-csharp before 2.7.0.

Recommended defensive actions

• Verify bc-csharp version and update to 2.7.0 or later if necessary
• Assess exposure and impact on systems using bc-csharp before 2.7.0
• Monitor for crafted PKCS#12 files being supplied to applications using bc-csharp
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify the bc-csharp version used in their systems and check for exposure. The vulnerability details indicate that an attacker can cause a denial of service by supplying a crafted PKCS#12 file, leading to an infinite loop and potential OutOfMemoryException. Evidence from the CVE record and NVD page suggests that defenders should prioritize verification and remediation

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.