CVE-2026-3505

CVE-2026-3505 is an uncontrolled resource consumption vulnerability affecting the BC-JAVA cryptographic library from Legion of the Bouncy Castle Inc., specifically in the bcpg modules used for PGP operations. The flaw exists in versions 1.74 through 1.83 and stems from improper resource allocation without limits or throttling in files including AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, and OperatorHelper.Java. This type of vulnerability could allow attackers to exhaust system resources through maliciously crafted inputs. The vulnerability carries a FAUCET risk score of 42.0/100 and an EPSS score of 0.00055, indicating relatively low predicted exploitability compared to the broader CVE population. Without available CVSS scoring data, precise details regarding attack vector and complexity are unavailable; however, the nature of resource exhaustion vulnerabilities typically requires network access and moderate complexity. The impact would likely manifest as denial of service through CPU or memory exhaustion in systems using the affected library. There is currently no evidence of active exploitation, as indicated by the CVE's absence from the Known Exploited Vulnerabilities catalog and its inactive status on the Hot List. No public exploit code has been reported, and community attention remains minimal. Organizations using affected BC-JAVA versions should upgrade to 1.84 or later as a preventative measure.