CVE-2026-3505

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3505
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3505.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-3505
Aliases
Downstream
Related
Published
2026-04-15T09:06:37.939Z
Modified
2026-08-18T04:16:54.603929197Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
Details

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).

This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Database specific 
{
    "cna_assigner": "bcorg",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3505.json"
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
434cab9b79adfcc7d0313fbaec765a5bbfb27128
Fixed
d3fbd45fd5e27fbc3a69b8ab150619f0dc8a6a44
Introduced
228211ecb973fe87fdd0fc4ab16ba0446ec1a29c
Fixed
dd0e7f83eef6b5d157139c9da21852d44bfcef71
Introduced
de42702b6cda2631e8e3ff94f8458198860b328e
Fixed
d716d7716a452bad283323aefd88ff21eba8deef
Fixed
dc7530939ffb6cdb57636f3609d98e23b94e71c1
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.74"
        },
        {
            "fixed": "1.80.2"
        },
        {
            "introduced": "1.81"
        },
        {
            "fixed": "1.81.1"
        },
        {
            "introduced": "1.82"
        },
        {
            "fixed": "1.84"
        }
    ]
}

Affected versions

Other
r1rv74
r1rv75
r1rv76
r1rv77
r1rv78
r1rv80
r1rv80v1
r1rv81
r1rv82
r1rv83

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3505.json"