CVE-2026-58059

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.

An algorithmic complexity vulnerability was found in Bouncy Castle for Java. The library performs quadratic-time escaping while stringifying X.500 distinguished names. An unauthenticated remote attacker can exploit this by passing a specially crafted X.500 distinguished name—such as within an X.509 certificate during TLS handshakes or PKI parsing operations—forcing high CPU resource consumption. This execution causes processing delays and leads to Denial of Service (DoS) for applications parsing untrusted distinguished names.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit the maximum string length of incoming X.500 distinguished names at application or API gateway boundaries, or restrict the acceptance of unauthenticated client certificates containing complex distinguished names.