CVE-2026-13586 is a high severity denial of service flaw (CVSS 7.5) in Bouncy Castle for Java. PKCS#12 keystore loading used iteration counts straight from the file, so a small crafted file can force heavy computation. Fixed in 1.85, LTS 2.73.12 and bc-fips 1.0.2.7.
What's affected
- Bouncy Castle for Java (bc-java) before 1.85, and the LTS line (bc-java LTS) before 2.73.12. Java 8 and later.
- Bouncy Castle FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Components: PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi.
- Fixed: 1.85, LTS 2.73.12, bc-fips 1.0.2.7, 2.0.2 and 2.1.3.
The Bouncy Castle advisory page gives no CVSS score or rating. The score here is the CVE record's: 7.5 High (availability only).
How to check if you're exposed
Bouncy Castle usually arrives as a transitive dependency, so start with the dependency tree rather than your own build file.
mvn dependency:tree -Dincludes=org.bouncycastle
gradle dependencies --configuration runtimeClasspath | grep -i bouncycastle
If you ship a fat jar or a container image, look inside the artifact too, because shaded copies do not show up in a dependency tree.
unzip -l app.jar | grep org/bouncycastle
Compare what you find with the fixed versions above. Look for code that opens PKCS#12 or PFX files from users, uploads or partner systems.
Paste your manifest into the free in-browser dependency scan to see whether an affected version is in your tree. Nothing needs to be installed.
What to do now
- Find every Bouncy Castle copy in your build, including shaded and bundled ones.
- Upgrade to the fixed version for the line you use, listed above.
- Rebuild and redeploy, then confirm the new version with the same commands.
- Avoid opening untrusted PKCS#12 keystores before upgrading. After upgrading, note the org.bouncycastle.pkcs12.max_it_count property that adjusts the default iteration ceiling.
Why it matters
The weakness is CWE-770 (Allocation of Resources Without Limits or Throttling). The advisory page says the keystore code used key derivation iteration counts read from the file, with no upper bound. A file only a few hundred bytes long can set a count near two to the power of 31, forcing heavy work before the password or integrity check fails.
The fix passes counts through a validator that rejects negative values and values of 2 to the power of 31 or more, and enforces a default ceiling of 5,000,000, adjustable through the org.bouncycastle.pkcs12.max_it_count property. Legitimate files with higher counts may need that property raised. The record does not list the CVE as exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I tune the new limit?
Yes. The page names the org.bouncycastle.pkcs12.max_it_count property for adjusting the default ceiling.
Does a wrong password protect me?
No. The heavy work happens before the password or integrity check fails.
Sources
Last reviewed: 18 October 2026.
