{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-58063","assignerOrgId":"91579145-5d7b-4cc5-b925-a0262ff19630","state":"PUBLISHED","assignerShortName":"bcorg","dateReserved":"2026-06-28T01:21:46.335Z","datePublished":"2026-08-03T02:29:09.708Z","dateUpdated":"2026-08-03T15:36:41.662Z"},"containers":{"cna":{"providerMetadata":{"orgId":"91579145-5d7b-4cc5-b925-a0262ff19630","shortName":"bcorg","dateUpdated":"2026-08-03T05:48:15.762Z"},"title":"BCFKS keystore load honours unbounded KDF cost from untrusted file","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"affected":[{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-JAVA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java/","packageName":"bcprov","repo":"https://github.com/bcgit/bc-java","packageURL":"pkg:maven/org.bouncycastle/bcprov-jdk18on","modules":["prov"],"programFiles":["BcFKSKeyStoreSpi"],"versions":[{"status":"affected","version":"0","lessThan":"1.85","versionType":"maven"}],"defaultStatus":"unaffected"},{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-LTS-JAVA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/","packageName":"bcprov-lts8on","repo":"https://github.com/bcgit/bc-lts-java","packageURL":"pkg:maven/org.bouncycastle/bcprov-lts8on","modules":["prov"],"programFiles":["BcFKSKeyStoreSpi"],"versions":[{"status":"affected","version":"2.73.0","lessThan":"2.73.12","versionType":"maven"}],"defaultStatus":"unaffected"},{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-FJA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/","packageName":"bc-fips","packageURL":"pkg:maven/org.bouncycastle/bc-fips","versions":[{"status":"affected","version":"1.0.0","lessThan":"1.0.2.7","versionType":"maven"},{"status":"affected","version":"2.0.0","lessThan":"2.0.2","versionType":"maven"},{"status":"affected","version":"2.1.0","lessThan":"2.1.3","versionType":"maven"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).</p>"}]}],"references":[{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063","tags":["vendor-advisory"]},{"url":"https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber"}}],"credits":[{"lang":"en","value":"Alex Gaynor in collaboration with Claude and Anthropic Research","type":"reporter"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"bc release-notes template"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T15:36:13.891376Z","id":"CVE-2026-58063","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T15:36:41.662Z"}}]}}