CVE-2026-59645

A flaw was found in Bouncy Castle for Java. A remote attacker could exploit this vulnerability by providing a specially crafted self-referential IEEE 1609.2 schema to the OER (Octet Encoding Rules) parser. This can cause the parser to recurse without a depth limit, leading to resource exhaustion and a denial of service (DoS) for the affected system.

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OER (Octet Encoding Rules) parser recurses without a depth limit on a self-referential IEEE 1609.2 schema, so a crafted schema causes resource exhaustion and a denial of service. This is reachable only via the OER / IEEE 1609.2 (V2X) code paths, a narrow surface for most products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcutil-fips 2.0.7/2.1.7) once available for the affected product.