BouncyCastle .NET X509Name String Conversion Denial of Service (CVE-2026-103604)

CVE-2026-103604 Vulnerability Summary When an is converted to a string, each attribute value is escaped according to RFC 4514: a backslash is added before every character, and before leading and trailing spaces. and (called by and ) scan these escapes by inserting strings after each backslash. Each move scans the remainder of the string. The values come from parsers that create certificates, CRLs, certificate requests, or other structures, and the parsing does not restrict their length. Applications are vulnerable if they convert subject names from untrusted input to strings (e.g., when calling to log or display the certificate subject/issuer, or when reading from directory entries). This issue is also exposed when a CA enforces constraints in the path. In our tests, converting a property value with 60,000 commas takes approximately one second, while 120,000 commas take two seconds. The cost increases with the square of the length of the converted value, allowing six parallel conversions to keep each CPU core busy. Parsing, , and are not affected. BC .NET 2.7.0 escapes each value in a single pass, appending to a new buffer rather than inserting into the buffer being scanned; thus, the time complexity is now linear with respect to the value's length. The same 120,000 character value now completes in two milliseconds. The resulting string is unchanged, so no longer adds extra backslashes for values consisting solely of spaces. No configuration changes are required. Users of earlier versions should immediately check the length of subject attribute values before converting them to strings. returns unescaped values, so applications can skip or truncate values for common name attributes (such as , , and ) that exceed 64 or 128 characters. Limiting the size of certificates, CRLs, and requests from untrusted parties also helps mitigate the cost, including checks for name constraints. Impact Scope Affected Versions: BC .NET 2.6.2 and earlier, as well as the 2.7.0-beta.98 pre-release version. Platform Impact: All CLR. Remediation Fixed Version: BC .NET 2.7.0. Fix Commit: Additional Information Discoverer: Claude, an AI assistant from Anthropic. Collaboration: Anthropic Security Team, in collaboration with Anthropic Research.

Goal Reached Thanks to every supporter — we hit 100%!

BouncyCastle .NET X509Name String Conversion Denial of Service (CVE-2026-103604)

More from this source