CVE‐2026‐13586

Title: PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS).

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived the integrity-MAC and bag-decryption keys using iteration counts read directly from the keystore file, with no upper bound. A small crafted PKCS#12 file declaring an iteration count close to 2^31 ties the loading thread up in key-derivation work before any password or integrity check can fail, so an application that opens untrusted keystores can be stalled by a file of a few hundred bytes. Iteration counts are now routed through PKCS12Util.validateIterationCount(), which rejects negative values and values of 2^31 or larger, and enforces a ceiling of 5,000,000 by default, adjustable via the org.bouncycastle.pkcs12.max_it_count property.

The fix was introduced in commit fa59cc23502f and commit 75d60dfb4ca7.

Credit: Alex Gaynor in collaboration with Claude and Anthropic Research.