CVE-2026-59649 is a high severity denial of service in the OpenPGP code of Bouncy Castle for Java. A user-attribute subpacket length is limited only by JVM memory, so importing a small crafted key can cause an OutOfMemoryError. Fixed in 1.85, LTS 2.73.12 and bcpg-fips 1.0.13, 2.0.13, 2.1.13.
What's affected
- Bouncy Castle for Java: before 1.85.
- Bouncy Castle for Java LTS: before 2.73.12.
- Bouncy Castle FIPS: before bcpg-fips 1.0.13 (1.0.X), 2.0.13 (2.0.X) and 2.1.13 (2.1.X).
- Platform: Java 8 and later.
- Who is exposed: applications that import or parse OpenPGP public keys from outside, for example from keyservers, WKD or attachments.
How to check if you're exposed
Find which Bouncy Castle artifacts and versions your build resolves, including indirect ones.
mvn dependency:tree -Dincludes=org.bouncycastle
./gradlew dependencies --configuration runtimeClasspath | grep -i bouncycastle
Look for artifacts such as bcprov, bcpkix, bcpg and bctls, and compare the version with the fixed versions above. Check shaded or fat jars and container images as well, because Bouncy Castle is often bundled inside other libraries and a copy can hide there.
Search your code for PGPPublicKeyRing, PGPObjectFactory and key import paths, and for the bcpg artifact in your dependency tree. The advisory describes the attacker route as getting a victim to import a public key from a keyserver, Web Key Directory or an email attachment. Services that ingest keys automatically, such as mail gateways and package signing tools, are the most exposed.
What to do now
- Upgrade to Bouncy Castle 1.85, LTS 2.73.12, or the fixed FIPS artifact listed above.
- Limit the size of key material you accept before parsing it.
- Import keys in a worker with a memory limit so a single bad key cannot take down the whole service.
- Turn off automatic key fetching from untrusted sources if you do not need it.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-789 (Memory Allocation with Excessive Size Value). The advisory says the parser reads a five byte length for a user attribute subpacket, up to the largest integer, and allocates an array of that size after checking only against a limit. That limit is computed from the stream and, for the stream types involved, falls back to the JVM's maximum memory. The real enclosing packet length was never consulted.
A few dozen bytes of input can therefore request an array near the size of the heap and trigger an OutOfMemoryError before the code notices the stream is short. The record scores it 7.5 (High) and does not mark it as exploited in the wild.
Quick check
What is the trigger?
Importing a crafted OpenPGP public key. The advisory mentions keyservers, WKD and attachments as ways to get a key in front of the victim.
Sources
Last reviewed: 18 October 2026.
