CVE-2026-63575: PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count
Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, to cause a denial of service through CPU exhaustion via an iteration count of zero or below, because the derivation loop ran until its counter equalled the count, so for such a count it wrapped through about 2^32 iterations before the MAC or the password could be checked. A 75-byte PFX file with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which applications are exposed to this denial of service?
Applications using bc-csharp before 2.7.0 are exposed if they process attacker-supplied PKCS#12/PFX files or PKCS#8 encrypted private keys that use a PKCS#12 password-based encryption algorithm.
Does exploitation require authentication or a valid password?
No. An attacker needs to supply a crafted file with an iteration count of zero or below; the excessive derivation occurs before the MAC or password can be checked.
What is the practical impact of a crafted file?
Processing the file can consume CPU while the derivation loop runs through roughly 2^32 iterations. A 75-byte PFX with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes.
What should teams do if they cannot immediately upgrade?
Avoid processing untrusted PKCS#12/PFX files and untrusted PKCS#8 encrypted private keys that use PKCS#12 password-based encryption. Where such processing is required, isolate it and apply resource limits to reduce the impact of CPU exhaustion.