CVE-2026-63578 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems using the bc-csharp library should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

Why it matters

Defenders should care about CVE-2026-63578 because it allows an attacker to cause a denial of service through CPU exhaustion in the bc-csharp library, potentially disrupting services that rely on private-key decryption. Affected systems and deployment contexts should be assessed for exposure, and patching or mitigation should be prioritized. The evidence supports the need for verification of affected versions and remediation status.

• Denial-of-service attacks through CPU exhaustion
• Potential disruption of services relying on private-key decryption
• Need for verification of affected versions and remediation status

Technical summary

The vulnerability exists in the PbeUtilities.GenerateCipherParameters function in the bc-csharp library, which allows an attacker to cause a denial of service through CPU exhaustion by supplying an encrypted private key with an iteration count close to 2^31. This function is used in various cryptographic operations, including PKCS#5 PBES1 and PBES2 (PBKDF2), the PKCS#12 PBE algorithms, and CMS password recipients (CmsPbeKey). Loading PKCS#12 files with Pkcs12Store is covered by CVE-2026-63572, and a zero or negative count with the PKCS#12 algorithms by CVE-2026-63575. The vulnerability can be triggered by an attacker supplying a maliciously crafted encrypted private key.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch bc-csharp to version 2.7.0 or later
• Implement compensating controls to limit the impact of potential denial-of-service attacks
• Monitor for suspicious activity related to private-key decryption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The source references provide additional information about the patches and vendor advisory. Evidence limits are based on available data and may change as new information becomes available. Affected versions are before 2.7.0, and defenders should verify the remediation status of bc-csharp in their environments. The CVE record was published on 2026-10-02T08:17:03.087Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.