CVE-2026-58059
Received Received - Intake

Quadratic-time escaping in Bouncy Castle for Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-58059
EUVD
EUVD-2026-52092

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle to 1.85 (exc)
bouncy_castle bouncy_castle_lts to 2.73.12 (exc)
bouncy_castle bc_fips to 1.0.2.7 (exc)
bouncy_castle bc_fips to 2.0.2 (exc)
bouncy_castle bc_fips to 2.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Bouncy Castle for Java involves quadratic-time escaping when stringifying X.500 distinguished names. It affects multiple versions including Bouncy Castle before 1.85, Bouncy Castle LTS before 2.73.12, and Bouncy Castle FIPS before specific versions in the 1.0.X, 2.0.X, and 2.1.X series.

Detection Guidance

Detection requires checking the Bouncy Castle library version in use. For Java applications, inspect the JAR files or dependency manifests (e.g., pom.xml for Maven) for versions before 1.85 (main), 2.73.12 (LTS), or specified BC-FJA versions. No direct network commands are applicable as this is a library-level issue.

Impact Analysis

The vulnerability could lead to denial of service due to high computational resource usage during string escaping operations. This may cause applications to slow down or crash when processing X.500 distinguished names.

Compliance Impact

The vulnerability involves quadratic-time escaping when stringifying X.500 distinguished names in Bouncy Castle for Java, which could lead to denial-of-service conditions. This may impact compliance by disrupting availability of cryptographic operations, potentially violating requirements for secure data processing under GDPR or HIPAA if systems fail to maintain expected performance or security.

Mitigation Strategies

Update Bouncy Castle for Java to version 1.85 or later. For LTS versions, upgrade to 2.73.12 or later. For BC-FJA, upgrade to bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), or 2.1.3 (2.1.X).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart