CVE-2026-59645 - OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

Back Back to CVE browser

HIGH

OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

Published Aug 3, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.49%

Description

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

Affected products

Vendor Legion of the Bouncy Castle Inc. Product BC-Fja Default
unaffected
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.0.7
- Version
  2.1.0
  Status
  affected
  Constraints
  <2.1.7
Vendor Legion of the Bouncy Castle Inc. Product BC-Java Default
unaffected
- Version
  1.70
  Status
  affected
  Constraints
  <1.85
Vendor Legion of the Bouncy Castle Inc. Product BC-Lts-Java Default
unaffected
- Version
  2.73.0
  Status
  affected
  Constraints
  <2.73.12

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Legion of the Bouncy Castle Inc.

BC-Fja

unaffected

Version	Status	Constraints
2.0.0	affected	<2.0.7
2.1.0	affected	<2.1.7

Legion of the Bouncy Castle Inc.

BC-Java

unaffected

Version	Status	Constraints
1.70	affected	<1.85

Legion of the Bouncy Castle Inc.

BC-Lts-Java

unaffected

Version	Status	Constraints
2.73.0	affected	<2.73.12

Red Hat AMQ Clients

bcprov-jdk15on

Not affected
Red Hat Enterprise Linux 8

pki-core:10.6/resteasy

Not affected
Red Hat Enterprise Linux 8

pki-deps:10.6/resteasy

Affected
Red Hat Enterprise Linux 9

resteasy

Affected
Red Hat JBoss Enterprise Application Platform 7

bcprov-jdk15on

Will not fix
Red Hat Single Sign-On 7

bcprov-jdk15on

Affected

Product	Package	State	Advisory
Red Hat AMQ Clients	bcprov-jdk15on	Not affected	n/a
Red Hat Enterprise Linux 8	pki-core:10.6/resteasy	Not affected	n/a
Red Hat Enterprise Linux 8	pki-deps:10.6/resteasy	Affected	n/a
Red Hat Enterprise Linux 9	resteasy	Affected	n/a
Red Hat JBoss Enterprise Application Platform 7	bcprov-jdk15on	Will not fix	n/a
Red Hat Single Sign-On 7	bcprov-jdk15on	Affected	n/a

Remediation

Red Hat statement

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OER (Octet Encoding Rules) parser recurses without a depth limit on a self-referential IEEE 1609.2 schema, so a crafted schema causes resource exhaustion and a denial of service. This is reachable only via the OER / IEEE 1609.2 (V2X) code paths, a narrow surface for most products.

Red Hat mitigation

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcutil-fips 2.0.7/2.1.7) once available for the affected product.

Weaknesses (2)

CWE-674

CWE-835

References (7)

https://access.redhat.com/security/cve/CVE-2026-59645
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2510189
Issue Tracking
https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989
patch
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059645
vendor-advisoryThird Party Advisory
https://github.com/bcgit/bc-java/wiki/CVE-2026-59645
https://nvd.nist.gov/vuln/detail/CVE-2026-59645
https://www.cve.org/CVERecord?id=CVE-2026-59645

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-59645		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2510189		Issue Tracking
https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989		patch
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059645		vendor-advisoryThird Party Advisory
https://github.com/bcgit/bc-java/wiki/CVE-2026-59645
https://nvd.nist.gov/vuln/detail/CVE-2026-59645
https://www.cve.org/CVERecord?id=CVE-2026-59645