CVE-2026-63578 BouncyCastle .NET Key Derivation DoS Advisory

CVE-2026-63578 Vulnerability Overview When decrypting a password-protected private key, the iteration count for the password-based key derivation is read from the algorithm parameters within the key itself. These parameters are not password-protected, meaning the key derivation must complete the decryption of the password or data before it can finish. PbeUtilities utilizes the iteration count precisely as provided, up to a maximum of 2^31 - 1, regardless of who generated the key or how much computational work they intended to require for decryption attempts. Applications are exposed if they decrypt PKCS#8 EncryptedPrivateKeyInfo structures (such as "ENCRYPTED PRIVATE KEY" PEM files read from untrusted sources, or keys passed via PrivateKeyFactory.DecryptKey or PrivateKeyInfoFactory.CreatePrivateKeyInfo). Both PKCS#5 PBES1 and PBES2 (PBKDF2) schemes, as well as PKCS#12 password-based derivation encryption algorithms, are affected. Additionally, the PBKDF2 key derivation for CMS Password Recipients (CmsEnvelopedData) is affected. The issue regarding zero or negative counts with PKCS#12 key derivation is covered under CVE-2026-63575. A forged key of approximately one hundred bytes can keep a decryption thread busy for roughly half an hour or longer, and the caller cannot cancel the operation regardless of the password provided. Repeated submissions may cause hangs on each worker thread. Loading PKCS#12 (PFX) files with Pkcs12Store, including encrypted private keys and encrypted content, is covered separately by CVE-2026-63572. BC .NET 2.7.0 checks the iteration count prior to each key derivation. For PBES1, PBES2, and CMS Password Recipients, the limit is set by the property "Org.BouncyCastle.Pbe.MaxIterationCount", and for PKCS#12 algorithms, it is set by "Org.BouncyCastle.Pkcs12.MaxIterationCount". Both default to 5,000,000 and can be adjusted via the Org.BouncyCastle.Utilities.Properties environment variable or set to 0 to disable. For PKCS#12 algorithms, larger counts are rejected with an ArgumentException or InvalidOperationException. The same limits apply when keys are encrypted via PbeUtilities or EncryptedPrivateKeyInfoFactory; therefore, applications requiring more than 5,000,000 iterations must adjust their configurations. Earlier versions lacked settings to limit the iteration count, so upgrading is recommended. If an immediate upgrade is not feasible, applications can parse the EncryptedPrivateKeyInfo (or CMS PasswordRecipientInfo) structure itself and reject iteration counts below 1, or enforce this expectation before passing the structure to Bouncy Castle. Impact Affected Platforms: All CLR Affected Versions: BC C.NET 2.6.2 and earlier, as well as 2.7.0-beta.98 pre-release versions Remediation Fixed Version: BC C.NET 2.7.0 Fix Commits: - Limit PBES2 Iteration Count - Limit PBES1 Iteration Count - Limit Iteration Count for PKCS#12 Algorithms - Move Limits to Org.BouncyCastle.Utilities.Properties - Apply Limits to CMS Password Recipients and Set Default to 5,000,000 Additional Information Corresponding Issue: BC Java 1.85 (CVE-2026-15055) Discoverer: Claude, AI Assistant from Anthropic Verified by: Anthropic Security Team in collaboration with Anthropic Research

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63578 BouncyCastle .NET Key Derivation DoS Advisory

More from this source