CVE-2026-58059 is a high severity denial of service in Bouncy Castle for Java. Escaping an X.500 distinguished name takes quadratic time, so one large certificate name can pin a CPU core. Fixed in Bouncy Castle 1.85, LTS 2.73.12 and bc-fips 1.0.2.7, 2.0.2 and 2.1.3.
What's affected
- Bouncy Castle for Java: versions before 1.85.
- Bouncy Castle for Java LTS: versions before 2.73.12.
- Bouncy Castle FIPS (BC-FJA): before bc-fips 1.0.2.7 in the 1.0.X series, 2.0.2 in the 2.0.X series and 2.1.3 in the 2.1.X series.
- Platform: Java 8 and later.
- Fixed: 1.85, 2.73.12, and the bc-fips versions listed above.
How to check if you're exposed
Find which Bouncy Castle artifacts and versions your build resolves, including indirect ones.
mvn dependency:tree -Dincludes=org.bouncycastle
./gradlew dependencies --configuration runtimeClasspath | grep -i bouncycastle
Look for artifacts such as bcprov, bcpkix, bcpg and bctls, and compare the version with the fixed versions above. Check shaded or fat jars and container images as well, because Bouncy Castle is often bundled inside other libraries and a copy can hide there.
Then ask where your code turns an untrusted name into text. The project advisory says the slow path is reached through X500Name.toString(), equals() and hashCode(), so logging a certificate subject, comparing names, or using names as cache keys are the typical triggers, including the JCA call getSubjectX500Principal().toString().
What to do now
- Upgrade to Bouncy Castle 1.85, LTS 2.73.12, or the fixed bc-fips release for your series.
- If you cannot upgrade at once, limit the size of certificates, CSRs and CRLs your service accepts before it parses them.
- Avoid logging or stringifying distinguished names from untrusted certificates until you are patched.
- Put a CPU time limit or request timeout on any endpoint that parses uploaded certificates.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-407 (Inefficient Algorithmic Complexity). The project advisory explains that the escaping code inserted a backslash into the same buffer it was scanning. Each insert shifts all trailing characters, so a value with N escapable characters costs roughly N squared over two character moves. A single name of about 60 KB made of commas or plus signs is enough to hold a core for seconds to minutes, according to the advisory.
The attacker needs no credentials, only a way to submit a certificate, CSR, CRL or CMS structure. A few parallel submissions can saturate a server. The record scores it 7.5 (High) and does not mark it as exploited in the wild.
Try it yourself
Bouncy Castle sits deep in many dependency trees and gets new advisories often. This demo shows continuous monitoring flagging a new CVE against a dependency you already ship.
Click through it at your own pace, or open it full screen.
Quick check
Does the fix change the output of name escaping?
The fix commit is titled 'Escape X.500 RDN values in linear time' and its comments state the output is unchanged. Only the cost of producing it changes.
Sources
Last reviewed: 18 October 2026.
