CVE-2026-63570: Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links
Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS#12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in which the call never returns and consumes CPU and memory until an OutOfMemoryException, via certificates whose issuer links form a cycle, for example two certificates whose AuthorityKeyIdentifier extensions each identify the other's public key. This happens because the chain-building loop stops only when no issuer is found or a certificate links to itself, and keeps no record of certificates already visited. The key-identifier links are followed without checking signatures.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which applications are exposed to this denial of service?
Applications using Bouncy Castle bc-csharp before 2.7.0 are exposed if they load an attacker-supplied PKCS#12 file and request the certificate chain for a key entry. The vulnerable chain-building logic follows issuer key-identifier links without signature validation.
What does an attacker need to exploit the issue?
An attacker must be able to provide a crafted PKCS#12 file to the application and cause it to request a key entry's certificate chain. No authentication or additional attack complexity is indicated, but user interaction is required by the CVSS vector.
How can I determine whether an affected file is triggering the vulnerability?
Affected processing may cause Pkcs12Store.GetCertificateChain not to return, with continued CPU and memory consumption until an OutOfMemoryException. The malicious certificate chain contains cyclic issuer links, such as two certificates whose AuthorityKeyIdentifier extensions identify each other's public key.
What is the remediation?
Upgrade Bouncy Castle bc-csharp to version 2.7.0 or later. The issue affects versions before 2.7.0.