CVE-2026-63572: Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files
Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file to cause a denial of service through CPU exhaustion via an iteration count close to 2^31 in the file's MacData or in the PBE parameters of an encrypted SafeContents or shrouded key bag, because the counts are taken from the file without an upper bound and the key derivation runs before the MAC or the password can be checked. A zero or negative count is covered by CVE-2026-63575. Pkcs12Utilities.ConvertToDefiniteLength is also affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using bc-csharp before 2.7.0 are exposed if they load PKCS#12/PFX files through Pkcs12Store.Load or process them with Pkcs12Utilities.ConvertToDefiniteLength. Exploitation requires an attacker to be able to supply the PKCS#12 file.
Does an attacker need the PKCS#12 password or a valid MAC to trigger the issue?
No. The affected key-derivation work occurs before the MAC or password can be checked, so a malicious file can cause CPU exhaustion without first passing those checks.
What malicious file property causes the CPU exhaustion?
A PKCS#12 file can specify an iteration count close to 2^31 in MacData or in PBE parameters for encrypted SafeContents or a shrouded key bag. The affected code accepts these file-provided counts without an upper bound.
What can be done while an upgrade is pending?
Do not allow untrusted parties to supply PKCS#12/PFX files to affected loading or conversion paths. Restrict processing to files from trusted sources until bc-csharp is upgraded to 2.7.0 or later.