CVE-2026-14682

A flaw was found in Bouncy Castle for Java, including its LTS and FIPS variants. This vulnerability allows a remote attacker to trigger an Out-Of-Memory (OOM) error by providing specially crafted input during a definite-length read operation. This unbounded memory allocation can lead to a Denial of Service (DoS), making the affected system or application unavailable.

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. An unbounded up-front memory allocation on a definite-length read lets a remote attacker trigger an Out-Of-Memory condition with crafted input, resulting in a denial of service. This is broadly reachable wherever Bouncy Castle parses untrusted encoded data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, BC-FJA bc-fips 1.0.2.7/2.0.2/2.1.3, or bctls-fips 1.0.24) once available for the affected product.