CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.2.7"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.2"
                },
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.1.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58063.json",
    "cna_assigner": "bcorg",
    "cwe_ids": [
        "CWE-770"
    ]
}

References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type

GIT

Repo

https://github.com/bcgit/bc-java

Events

Introduced

Fixed

57fbd3c501f7a369f64eda311d6a709fc0bcae84

Fixed

81737a56ef4489da1f849cf549df95e338ea6b06

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.85"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Type

GIT

Repo

https://github.com/bcgit/bc-lts-java

Events

Introduced

468b5082f3f0971e80bf9edb7029c17b39b9ba0c

Fixed

f101b232c5d3e07ecdd504210a57e43831d6cd65

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.73.0"
        },
        {
            "fixed": "2.73.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

r1rv73

r1rv74

r1rv75

r1rv76

r1rv77

r1rv78

r1rv80

r1rv81

r1rv82

r1rv83

r1rv84

r2rv73dot0

r2rv73dot1

r2rv73dot10

r2rv73dot11

r2rv73dot3

r2rv73dot4

r2rv73dot6

r2rv73dot8

r2rv73dot9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58063.json"