CVE-2026-63575 PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
An attacker can cause CPU exhaustion and denial of service by supplying a PKCS#12 file with a zero or negative iteration count to the Bouncy Castle C# library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-63575?
CVE-2026-63575 is a high-severity denial of service vulnerability in Legion of the Bouncy Castle Inc. bc-csharp, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, to cause a denial of service through CPU exhaustion via an iteration count of zero or below, because the derivation loop ran until its counter equalled the count, so for such a count it wrapped through about 2^32 iterations before the MAC or the password could be checked. A 75-byte PFX file with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes.
Weakness: CWE-835
Which versions are affected by CVE-2026-63575?
It affects 1 product.
Products include Bouncycastle Bc-Csharp.
How do I fix CVE-2026-63575?
No fix has been published for CVE-2026-63575 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63575 being exploited?
There is no known exploitation of CVE-2026-63575 in the wild and no public exploit code.
Other vulnerabilities in Legion of the Bouncy Castle Inc. bc-csharp
- CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
- CVE-2026-103600 Unbounded ASN.1 nesting depth causes process-terminating stack overflow
- CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification
- CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings
- CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used
Sources
Also known as GHSA-7c84-x75c-5j8m.