CVE-2026-103603: Unbounded HSS public key level count allows huge array allocation during signature verification
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using Bouncy Castle C# before 2.7.0 are exposed if they perform HSS/LMS signature verification on both a public key and signature supplied by a remote unauthenticated party.
What input does an attacker need to provide?
The attacker must be able to supply an HSS public key encoding and a signature for verification. The public key's level count can be set above the RFC 8554 maximum of 8, causing signature parsing to allocate an array based on that value.
What is the operational impact of a successful attempt?
A single verification can commit approximately 17 GB of memory or throw an OutOfMemoryException. This can exhaust process or host memory and deny service.
What can be done before upgrading?
Do not accept attacker-controlled HSS public keys for verification, or validate the encoded HSS level count before invoking the affected parsing and verification code. The level count should not exceed 8 under RFC 8554.