CVE-2026-63575

Katalog CVE

CVSS 7.1 · High EPSS 0,19%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop'). Skor CVSS 4.0 7.1 (High) menurut CNA.

Deskripsi (NVD)

Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, to cause a denial of service through CPU exhaustion via an iteration count of zero or below, because the derivation loop ran until its counter equalled the count, so for such a count it wrapped through about 2^32 iterations before the MAC or the password could be checked. A 75-byte PFX file with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes.

Rincian

Terbit di NVD

2 Oktober 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 4.0

7.1 (High), sumber CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/bcgit/bc-csharp/commit/0c7a6dfd64c4a479577e35a728a766721b79aba7
• https://github.com/bcgit/bc-csharp/commit/7c0ed15f9783c9595b1a53f3900136461fd944f4
• https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63575