CVE-2026-14682
Received Received - Intake

Memory Exhaustion in Bouncy Castle Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-14682
EUVD
EUVD-2026-52132

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle to 1.85 (exc)
bouncy_castle bouncy_castle_lts to 2.73.12 (exc)
bouncy_castle bc_fips to 1.0.2.7 (exc)
bouncy_castle bc_fips to 2.0.2 (exc)
bouncy_castle bc_fips to 2.1.3 (exc)
bouncy_castle bctls_fips to 1.0.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Bouncy Castle for Java versions before 1.85 and related FIPS versions involves a possible out-of-memory (OOM) error. It occurs due to unbounded up-front memory allocation during a definite-length read operation, which can exhaust system resources.

Detection Guidance

Detection involves checking the version of Bouncy Castle libraries in use. Commands like 'find / -name "bc*.jar" 2>/dev/null' or 'mvn dependency:tree' can help identify installed versions. Compare detected versions against vulnerable releases (Java before 1.85, LTS before 2.73.12, FIPS series before specified versions).

Impact Analysis

An attacker could exploit this to cause denial-of-service conditions by triggering excessive memory consumption, potentially crashing applications or systems using vulnerable Bouncy Castle versions.

Compliance Impact

This vulnerability causes an out-of-memory (OOM) condition due to unbounded allocation during definite-length reads in Bouncy Castle libraries. While it does not directly impact data confidentiality or integrity, OOM errors can lead to service disruptions or crashes, potentially affecting availability of systems handling sensitive data. This could indirectly impact compliance with standards like GDPR (availability requirements) or HIPAA (accessibility of protected health information).

Mitigation Strategies

Upgrade Bouncy Castle libraries to patched versions: Java to 1.85+, LTS to 2.73.12+, FIPS series to specified versions. Remove or replace vulnerable dependencies in projects. Monitor memory usage for OOM errors as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart