CVE-2026-63578: Unbounded PBE iteration count when decrypting PKCS#8 private keys

Q: Who is exposed to this denial-of-service issue?

Applications using bc-csharp before 2.7.0 are exposed if they decrypt attacker-supplied encrypted private keys. Relevant inputs include PKCS#8 EncryptedPrivateKeyInfo structures and PEM files labeled "ENCRYPTED PRIVATE KEY."

Q: What does an attacker need to do to trigger the issue?

An attacker needs to provide an encrypted private key with an iteration count close to 2^31 in unauthenticated algorithm parameters. No authentication or valid password is required before the expensive key derivation begins, and the result is CPU exhaustion.

Q: Which password-based encryption paths are affected?

Affected paths include PKCS#5 PBES1, PBES2 using PBKDF2, PKCS#12 PBE algorithms, and CMS password recipients through CmsPbeKey. PKCS#12 files loaded with Pkcs12Store are addressed separately by CVE-2026-63572.

Q: How can teams identify potentially affected code paths?

Review uses of bc-csharp before 2.7.0 that accept or process encrypted PKCS#8 private keys or encrypted PEM private-key files from untrusted sources. Also review code using the listed PKCS#5, PKCS#12, or CMS password-recipient decryption paths.

Published Oct 2, 2026

Updated

Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS#8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVATE KEY" PEM file, to cause a denial of service through CPU exhaustion via an iteration count close to 2^31, because the count is taken from the unauthenticated algorithm parameters without an upper bound and the key derivation runs before the password or the data can be checked. PKCS#5 PBES1 and PBES2 (PBKDF2), the PKCS#12 PBE algorithms and CMS password recipients (CmsPbeKey) are affected. Loading PKCS#12 files with Pkcs12Store is covered by CVE-2026-63572, and a zero or negative count with the PKCS#12 algorithms by CVE-2026-63575.

Affected Software

1 affected component

Legion of the Bouncy Castle Inc. bc-csharp<2.7.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:08 AM

Data Sourced

via MITRE·07:08 AM

DescriptionWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using bc-csharp before 2.7.0 are exposed if they decrypt attacker-supplied encrypted private keys. Relevant inputs include PKCS#8 EncryptedPrivateKeyInfo structures and PEM files labeled "ENCRYPTED PRIVATE KEY."

What does an attacker need to do to trigger the issue?

An attacker needs to provide an encrypted private key with an iteration count close to 2^31 in unauthenticated algorithm parameters. No authentication or valid password is required before the expensive key derivation begins, and the result is CPU exhaustion.

Which password-based encryption paths are affected?

Affected paths include PKCS#5 PBES1, PBES2 using PBKDF2, PKCS#12 PBE algorithms, and CMS password recipients through CmsPbeKey. PKCS#12 files loaded with Pkcs12Store are addressed separately by CVE-2026-63572.

How can teams identify potentially affected code paths?

Review uses of bc-csharp before 2.7.0 that accept or process encrypted PKCS#8 private keys or encrypted PEM private-key files from untrusted sources. Also review code using the listed PKCS#5, PKCS#12, or CMS password-recipient decryption paths.

CVE-2026-63578: Unbounded PBE iteration count when decrypting PKCS#8 private keys

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Which password-based encryption paths are affected?

How can teams identify potentially affected code paths?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Which password-based encryption paths are affected?

How can teams identify potentially affected code paths?