BouncyCastle PKCS12 Iteration Count DoS Vulnerability (CVE-2026-63572)

CVE-2026-63572 Vulnerability Overview When opens a PKCS#12 (PFX) file, it derives keys from the file itself using iteration counts retrieved from the file. These counts are used for the integrity MAC in MacData, as well as for each encrypted SafeContents and each PKCS#8 encrypted key. The integrity of the file cannot be verified until the MAC calculation is complete. Earlier versions used the given counts, up to 2^31 - 1. Zero or negative counts caused the PKCS#12 key derivation to loop approximately 2^32 times, a separate issue covered by CVE-2026-63575. recalculates the MAC and has the same issue. Applications loading PKCS#12 files from untrusted sources are exposed to risk, such as services accepting uploaded certificates and keys, or tools importing keys. The attacker does not need to know the password. On a typical desktop, with files under 80 bytes, the iteration count for each encrypted SafeContents keeps the load time at least a quarter of a second, or twice if the password is long. Files without a MAC and forged counts in encrypted packages require 20 to 40 minutes. Callers cannot cancel the work, and repeated files slow down each worker thread. BC .NET 2.7.0 checks each iteration count before deriving keys. MACs and content encrypted using PKCS#12 algorithms, such as , are limited by the property "Org.BouncyCastle.Pkcs12.MaxIterationCount". Content encrypted using PBES2 (PBKDF2) or PBES1 is limited by "Org.BouncyCastle.Pkcs.MaxIterationCount", which also applies to the private key covered by CVE-2026-63578. Counts over 5,000,000 can be set via environment variables or per-thread through . Counts exceeding the limit cause to throw an (for MAC and PKCS#8 algorithms) or (for PBES1 and PBES2), rather than an , before any key derivation completes. Applications that intentionally create PKCS#12 files with more than 5,000,000 iterations need to raise the limit. Earlier versions did not set these limits, so upgrading is recommended. If an immediate upgrade is not possible, applications can parse the file using and then call . If the MacData iteration count, the count in the encrypted SafeContents parameter, or the count in a forged encrypted package is less than 1 or greater than expected, it should be rejected. Loading will only proceed to the password check if the file also provides a password. The corresponding issue was fixed in BC Java 1.85 (CVE-2026-13586). Affected Versions Affected Versions: BC .NET 2.6.2 and earlier, including the 2.7.0-beta.98 pre-release version Fixed Version: BC .NET 2.7.0 Platform Impact: All CLR Remediation Upgrade to BC .NET 2.7.0 or later. If an immediate upgrade is not possible, applications can parse the file using and then call . If the MacData iteration count, the count in the encrypted SafeContents parameter, or the count in a forged encrypted package is less than 1 or greater than expected, it should be rejected. Loading will only proceed to the password check if the file also provides a password. Fixed Commits https://github.com/bcgit/bc-csharp/commit/7c0ed15f9783c9599b1a53f390136461f9444d (Limit iteration counts for MAC and PKCS#12 algorithms) https://github.com/bcgit/bc-csharp/commit/c00c018fcab9c077c64da22a2eb00e7097241 (Limit PBES1 iteration count) https://github.com/bcgit/bc-csharp/commit/54ea0b179ee627027828b44c5dd6d32e575bd67 (Limit PBES1 iteration count) https://github.com/bcgit/bc-csharp/commit/34a7c05f719c91024f28c6b420d3c0018fd90 (Move limits to and finalize PKCS#12 property names) https://github.com/bcgit/bc-csharp/commit/b75716ebc7790ecae08273b219d52d80c12990e4 (Set default PBES1/PBES2 value to 5,000,000)

Goal Reached Thanks to every supporter — we hit 100%!

BouncyCastle PKCS12 Iteration Count DoS Vulnerability (CVE-2026-63572)

More from this source