CVE-2026-3505

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

HIGH

7.5

CVSS Score

Published: April 15, 2026 at 09:06 AM UTC

Updated: October 26, 2026 at 10:10 PM UTC

8 products affected across 2 vendorsBC JavaEnterprise LinuxJBoss Enterprise Application Platform

Using BC-JAVA by Legion of the Bouncy Castle Inc.?

Get instant alerts when new vulnerabilities affect BC-JAVA - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).This issue affects BC-JAVA: before 1.84. Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BC Java · Legion of Bouncy Castlemaven

90%

1.74 ≤ v < 1.80.21.81 ≤ v < 1.81.11.82 ≤ v < 1.841.74 1.81 1.82

Affected range stops below 1.80.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.81.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.84, so it looks safe — our inference, not a vendor statement

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Enterprise Linux · Red Hatrpm

60%

Fuse · Red Hatrpm

60%

JBoss Enterprise Application Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-2.SP3_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 1.84.0.redhat-1 (unaffected)

OpenShift Developer Tools and Services · Red Hatrpm

60%

All versions

Vendor states this is fixed in 1786533561 (unaffected)

Vendor states this is fixed in 1786533565 (unaffected)

Vendor states this is fixed in 1786628667 (unaffected)

Vendor states this is fixed in 1786628681 (unaffected)

Vendor states this is fixed in 1787124632 (unaffected)

Vendor states this is fixed in 1787124635 (unaffected)

Vendor states this is fixed in 1787124779 (unaffected)

Vendor states this is fixed in 1787124925 (unaffected)

Vendor states this is fixed in 1787125069 (unaffected)

Vendor states this is fixed in 1787125166 (unaffected)

Vendor states this is fixed in 1787125311 (unaffected)

Process Automation · Red Hatrpm

60%

Single Sign on · Red Hatrpm

60%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (25)

Vendor Advisory

Source: cverecord

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505

Patch

Source: cverecord

https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1