CVE-2026-103600: Unbounded ASN.1 nesting depth causes process-terminating stack overflow

Q: Which deployments are exposed to this issue?

Any application using bc-csharp before 2.7.0 is exposed if it parses attacker-controlled ASN.1 data. Relevant inputs include X.509 certificates and CRLs, CMS/PKCS#7, PKCS#8 or PKCS#12, OCSP, and TLS Certificate messages.

Q: What does an attacker need to exploit it?

The attacker only needs a path to submit crafted ASN.1 input; no authentication or user interaction is required. The input contains deeply nested constructed elements, such as nested SEQUENCE values, in DER or BER encoding.

Q: What is the operational impact?

Approximately 2,000 nesting levels, or about 8 KB of DER input, can exhaust a 1.5 MB Windows .NET main-thread stack and terminate the entire process with an uncatchable StackOverflowException. On threads with larger stacks, deeply nested input can instead cause high CPU consumption because parsing time grows quadratically with nesting depth.

Q: What should be done if upgrading is not immediately possible?

Prevent untrusted ASN.1 data from reaching the affected parser where possible, including untrusted certificates, CRLs, CMS, PKCS containers, OCSP responses, and TLS Certificate messages. Inputs with excessive constructed-element nesting should be rejected before they are passed to Asn1InputStream or Asn1StreamParser.

Published Oct 2, 2026

Updated

Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements (for example SEQUENCE inside SEQUENCE, in definite-length DER or indefinite-length BER form), because each nesting level is parsed by a further recursive call with no bound on depth. About 2,000 levels (8 KB of DER) are enough to exhaust a 1.5 MB thread stack, the .NET main-thread default on Windows, and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process; on threads with larger stacks, parse time instead grows quadratically with depth (about 9 seconds of CPU for a 64 KB input). Any path that parses untrusted ASN.1 is exposed, including X.509 certificates and CRLs, CMS/PKCS#7, PKCS#8/PKCS#12, OCSP and TLS Certificate messages.

Affected Software

1 affected component

Legion of the Bouncy Castle bc-csharp<2.7.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:08 AM

Data Sourced

via MITRE·07:08 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Any application using bc-csharp before 2.7.0 is exposed if it parses attacker-controlled ASN.1 data. Relevant inputs include X.509 certificates and CRLs, CMS/PKCS#7, PKCS#8 or PKCS#12, OCSP, and TLS Certificate messages.

What does an attacker need to exploit it?

The attacker only needs a path to submit crafted ASN.1 input; no authentication or user interaction is required. The input contains deeply nested constructed elements, such as nested SEQUENCE values, in DER or BER encoding.

What is the operational impact?

Approximately 2,000 nesting levels, or about 8 KB of DER input, can exhaust a 1.5 MB Windows .NET main-thread stack and terminate the entire process with an uncatchable StackOverflowException. On threads with larger stacks, deeply nested input can instead cause high CPU consumption because parsing time grows quadratically with nesting depth.

What should be done if upgrading is not immediately possible?

Prevent untrusted ASN.1 data from reaching the affected parser where possible, including untrusted certificates, CRLs, CMS, PKCS containers, OCSP responses, and TLS Certificate messages. Inputs with excessive constructed-element nesting should be rejected before they are passed to Asn1InputStream or Asn1StreamParser.

CVE-2026-103600: Unbounded ASN.1 nesting depth causes process-terminating stack overflow

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

What should be done if upgrading is not immediately possible?