CVE-2026-17508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-17508
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-17508.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-17508
Downstream
CLEANSTART (2)
DEBIAN (1)
openSUSE (1)
SUSE (1)
UBUNTU (1)
Related
Published
2026-10-02T07:27:59Z
Modified
2026-10-22T16:31:47Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points
Details

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Database specific 
{
    "cna_assigner": "bcorg",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17508.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.0.0"
                        },
                        {
                            "fixed": "1.0.13"
                        },
                        {
                            "introduced": "2.0.0"
                        },
                        {
                            "fixed": "2.0.13"
                        },
                        {
                            "introduced": "2.1.0"
                        },
                        {
                            "fixed": "2.1.13"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eacda831fbe15b272933e40841d8b0827b556fae
Fixed
882fdab53f6c4c150a5d6a4e6ef1fc05d382385a
Fixed
442393bf187c914b1e66fbed4fab532a1fe06c6a
Fixed
20ed9e203caec91d25cd386ceb6d364e9b068f67
Fixed
766a31026ac24ed3c6cad8662058ba450c338da1
Fixed
e72bc0681ff4227fced912ef7394daf7b7d57bb3
Fixed
480d878aa6f7dc8b20403064f304bbe0decbbb1a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.86"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "882fdab53f6c4c150a5d6a4e6ef1fc05d382385a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "442393bf187c914b1e66fbed4fab532a1fe06c6a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "20ed9e203caec91d25cd386ceb6d364e9b068f67"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "766a31026ac24ed3c6cad8662058ba450c338da1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e72bc0681ff4227fced912ef7394daf7b7d57bb3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "480d878aa6f7dc8b20403064f304bbe0decbbb1a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}
Type
GIT
Repo
https://github.com/bcgit/bc-lts-java
Events
Introduced
468b5082f3f0971e80bf9edb7029c17b39b9ba0c
Fixed
43d27611d3b82e54050d1def60b516f8295e485b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.73.0"
                },
                {
                    "fixed": "2.73.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

Other
r1rv73
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot12
r2rv73dot12dot1
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-17508.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "283110061590036587346140784364806476776",
            "length": 1232
        },
        "id": "CVE-2026-17508-0a1e3d25",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java",
            "function": "engineGenerateSecret"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "3532462878738421948164858213095046500",
            "length": 1235
        },
        "id": "CVE-2026-17508-0b4eebfb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/util/PKCS12Util.java",
            "function": "calculatePBMAC1"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "138181247408899040249400018688599970935",
                "157076650123742976017600283311648688772",
                "299831574497901735587913555181378186651",
                "119656624553792833336683544475511307167",
                "285360667363707167858519504783424612322"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-0d8eac13",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target": {
            "file": "tls/src/main/java/org/bouncycastle/jsse/provider/BouncyCastleJsseProvider.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "63319963188403829209068449128093887435",
            "length": 1587
        },
        "id": "CVE-2026-17508-251e0655",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "calculatePbeMac"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155019029517872758948943640080858056963",
            "length": 780
        },
        "id": "CVE-2026-17508-29dac85f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java",
            "function": "wrapKey"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177372076277804437512899947210065627078",
                "15048866475006312922981258517278481356",
                "22078776289913616242838906691542453056",
                "248814392144302448595496370577364238842"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-2a79e8ea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198998642969818417039950766575124474122",
                "176485554327561807626586916754186965744",
                "30122234930542453359703034466236659062",
                "145259701364354400312802743171023262636"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-2bd8f355",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/crypto/CryptoServicesRegistrar.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "92990237564067571128614587685345852577",
            "length": 4437
        },
        "id": "CVE-2026-17508-2f9e43f5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PBETest.java",
            "function": "performTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244745747811695624857402889631808812229",
            "length": 962
        },
        "id": "CVE-2026-17508-386eb3cd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java",
            "function": "createPBMac1Calculator"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "134902664215026488269659596688903720364",
                "321494922550655676952259179890383081274",
                "217078069302867107462901331274123897729",
                "293960044425652652591741690912802394992",
                "259374364529406847406173160088458655021",
                "272849904686859689384915313250555479056",
                "164123936555443215830704205402857699178",
                "146220011011113328214267649677391866772",
                "284772396699507661284043632718803632774",
                "110205475660799871836905570035032413971",
                "56071328906626365426443586358241819754",
                "149856882257116249034692839616809467717",
                "241406231014599686536294786522080062270"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-3b933a7f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "153466990862143956830728538826340073704",
                "210892785238532880238625028160545013800",
                "233236525985106636224995955227067511713",
                "210868507209189839146596226719779630199",
                "8360403756567106919202635173480009716",
                "2351170751805005132173375205833613020",
                "275127154265805873452987481850280636094",
                "70208624790161346476788624317741465020"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-3d4b2726",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePBMac1CalculatorBuilder.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "107492299239844656455992969154194751546",
                "88031704519188679500783664866555175428",
                "8719723814761448299496542886894605159",
                "203626202713639004218273365189024195254"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-3e15219a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "8211181235356044565010721458359054079",
                "334743777587131804541160416180084776948",
                "179877466538714796600241055590233192740"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-48342561",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12Util.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "307860442614700439199040851585867362343",
                "279150346697505203950309963335800561799",
                "137290408825349102829031917334217422874",
                "303786571307348167826831367606933390934",
                "177372076277804437512899947210065627078",
                "15048866475006312922981258517278481356",
                "22078776289913616242838906691542453056",
                "248814392144302448595496370577364238842"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-50025df1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "139867803237396682641081466549758336153",
                "308221974945910984033600577695600983508",
                "135710472373338193186849335037018287695",
                "126522775330737478726206029567721436164",
                "25113821050651111864947385530584717470",
                "198958448298138399197598378511954713568",
                "50078579185754280997268693536544198120",
                "45068795002974006330867991231356558146",
                "185762335740824778451305652563137498647",
                "113895930192366550830632676367506843565",
                "131303093928442533608374907449067022448"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-692f2a99",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/openssl/jcajce/JceOpenSSLPKCS8DecryptorProviderBuilder.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "15037932978976058678046096832551679440",
            "length": 167
        },
        "id": "CVE-2026-17508-69554e16",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java",
            "function": "BouncyCastleProvider"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "216178916484834625407626406325803398449",
                "17715739628611453223766295590303368001",
                "85616682715101955393045027577114077524"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-70fb5441",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/util/Properties.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "327069873105463730607406971638290175233",
            "length": 133
        },
        "id": "CVE-2026-17508-74c7dc30",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java",
            "function": "engineInit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124363420934960697109055482382257769524",
                "181486092088674459121436007917360830492",
                "90223259664771688824804326707367408907",
                "245714155879004258813282839552257861254",
                "229227945700071131397834021049953495296",
                "305046736122872946742997289374650429888",
                "248814392144302448595496370577364238842"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-82550af7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/util/PKCS12Util.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "289503176771193056709936743169829097826",
            "length": 1461
        },
        "id": "CVE-2026-17508-8a389ffc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePBMac1CalculatorBuilder.java",
            "function": "build"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "12613510752962270572759754650572988992",
                "75418705673854299014871424648533290037",
                "256793528079807414556707092093018039664",
                "190884975884083543966345398492896660870",
                "177372076277804437512899947210065627078",
                "338665435692295360757516559898364705284",
                "80170726212568837937195101355155615762",
                "110010011176840908427439695410389965883"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-8a854f70",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "242709525740693464710427490155770468404",
                "248642779262357672847364455182716518927",
                "61814954006545347336174517664014600025",
                "330018612005703343214037579938126279111",
                "242829773328378005944812852432809826984",
                "79254956226836762206179235050231922419",
                "209487308353917155254006337248362131884",
                "106210232137615890613524585425523676440",
                "18549171508569019471478065680037232028",
                "89074046693925405438872018885514326583",
                "41518768961989073683430800842658785826"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-8aad8c12",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3",
        "target": {
            "file": "core/src/test/java/org/bouncycastle/crypto/test/OpenSSHKeyParsingTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "325308758955859088059217355439500741141",
                "239865648952890385547258985686970835227",
                "143891873480768506591726871039049435685"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-9623a688",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a",
        "target": {
            "file": "pkix/src/test/java/org/bouncycastle/pkcs/test/PfxPduTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "30437902715218948892537259822511053179",
                "184373378579193858500056961183893769995",
                "257797085308409003202193516822381393948",
                "59551789984047946024383357433947736273",
                "182113889247115181043375752956355345480",
                "266503544064845017451436106007798517075",
                "102432188003067764207645616102555648411"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-9f56ac21",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/crypto/util/OpenSSHPrivateKeyUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "296719704855993444941507456823150627078",
            "length": 2371
        },
        "id": "CVE-2026-17508-addc41b8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/crypto/util/OpenSSHPrivateKeyUtil.java",
            "function": "decryptOpenSSHV1"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "263231788446534084400473174623577175852",
                "95237199885192598363211553346757310909",
                "219387587931115958615432237730990949245",
                "130247733194767326409842075146711308",
                "280970611085530692133656523796269063701",
                "64151451290514701110214790872123532347",
                "278653812449156399570546490829005804677",
                "2141221302420564606997591597181611262",
                "54535801004284265464791551918498173940",
                "280036114443425543801991002035779767100",
                "12452297812687175470203374378364877774",
                "298011660510322377549117364281775529009",
                "323586452896178042008770795020826008454",
                "248885161557171674979122244331868205158"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-ae8e4d5e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/BCFKSStoreTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "40664250943978140959169425650395655686",
            "length": 713
        },
        "id": "CVE-2026-17508-b15bb361",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePKCSPBEInputDecryptorProviderBuilder.java",
            "function": "checkScryptCost"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "40664250943978140959169425650395655686",
            "length": 713
        },
        "id": "CVE-2026-17508-bb53f466",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/openssl/jcajce/JceOpenSSLPKCS8DecryptorProviderBuilder.java",
            "function": "checkScryptCost"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "142371656489435841291433171748938768211",
                "276114836867604848252227924564245563626",
                "174725713112723821587285552842847152170",
                "296396029911940671522003416275304613740",
                "306388871444103436989662018391338496270",
                "187304475125762585622491255445396488097",
                "161374838074741889965706815960646264073"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-be411bea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PBETest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "28483275931710038995848972429745695640",
            "length": 1909
        },
        "id": "CVE-2026-17508-c04560d7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java",
            "function": "generateKey"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "144297674496070486364361882089719466188",
            "length": 1990
        },
        "id": "CVE-2026-17508-db1b856f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java",
            "function": "calculatePbeMac"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "219729498584516135347313253161027034708",
            "length": 414
        },
        "id": "CVE-2026-17508-dbde2a1e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/BCFKSStoreTest.java",
            "function": "performTest"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "169931635468607003376618791414613094911",
                "74397421977926187762966918859114398122",
                "243214200936403498328876083394014772123",
                "291744629460853391573348941247192264418",
                "113313564231216399987676023854883786284",
                "325297496715787280598399275629719060464",
                "87581935148775522401043082521698631590",
                "190172883396378728093632585176996295869",
                "215815260039460687782956113028593029634",
                "276357864747365853053590127307232532421",
                "157471025905011501688577818374383343462"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-e7f08ab6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a",
        "target": {
            "file": "prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "139867803237396682641081466549758336153",
                "308221974945910984033600577695600983508",
                "135710472373338193186849335037018287695",
                "126522775330737478726206029567721436164",
                "25113821050651111864947385530584717470",
                "198958448298138399197598378511954713568",
                "50078579185754280997268693536544198120",
                "45068795002974006330867991231356558146",
                "185762335740824778451305652563137498647",
                "113895930192366550830632676367506843565",
                "131303093928442533608374907449067022448"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-ec88d036",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePKCSPBEInputDecryptorProviderBuilder.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335932553205252043829837728149826599526"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-17508-f74c818e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a",
        "target": {
            "file": "pkix/src/test/java/org/bouncycastle/pkcs/test/PBETest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "63939824639301362127446589712112635591",
            "length": 174
        },
        "id": "CVE-2026-17508-fc61aedd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3",
        "target": {
            "file": "core/src/test/java/org/bouncycastle/crypto/test/OpenSSHKeyParsingTests.java",
            "function": "performTest"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T16:31:47Z"