CyberRota Analysis
AI-GeneratedBouncy Castle for Java versions prior to 1.85, along with specific LTS and FIPS versions, are vulnerable due to the BCFKS keystore loading process, which improperly honors unbounded Key Derivation Function (KDF) costs from untrusted files. This flaw could allow an attacker to exploit the KDF settings, potentially leading to denial of service or excessive resource consumption. Organizations using affected versions of Bouncy Castle for cryptographic operations should prioritize patching to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).