CVE-2026-59649

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OpenPGP user-attribute subpacket length is bounded only by the JVM maximum memory, so processing a specially crafted OpenPGP message causes excessive memory consumption and a denial of service. This is reachable only via the OpenPGP (bcpg) code paths; products that do not parse untrusted OpenPGP messages are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product.