CVE-2026-13506: bouncycastle bc-java Uncontrolled Recursion

CVSS: 8.7v4.0HighAnalyzed

AliasesUBUNTU-CVE-2026-13506DEBIAN-CVE-2026-13506CGA-22gw-wff9-wh3w+367 more

Published 03-08-2026Last modified 03-08-2026

Vulnerability summary

CVE-2026-13506 is a high (CVSS 8.7) Uncontrolled Recursion vulnerability in bouncycastle bc-java. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

0.44%

0%100%

Low · +0.13 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 6

OPENSUSE-SU-2026:11445-1 OPENSUSE-SU-2026:21538-1 SUSE-SU-2026:23127-1 SUSE-SU-2026:23150-1 SUSE-SU-2026:3559-1 CGA-6HPM-WGQR-FHF2

Timeline

03-08-2026
PublishedVulnerability first disclosed.
03-08-2026
Last modifiedVulnerability information updated.

Description

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS metrics

10 scores · 7 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

+0.13 pp

From 0.31% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Chainguard142 products

airbyte-platform-workload-launcher< 2.0.0-r8
apache-nifi-2.11All versions (No fix recorded)
apache-nifi-2.12< 2.12.0-r1
apache-nifi-registry-2.11< 2.11.0-r4
apache-nifi-registry-2.12< 2.12.0-r1

apache-pulsar-4.0< 4.0.13-r4
apache-pulsar-4.2< 4.2.4-r5
apache-pulsar-fips-4.0< 4.0.13-r4
apache-pulsar-fips-4.2< 4.2.4-r5
bouncycastle-fips< 2.1.3-r0
camunda-8.8< 8.8.39-r1
camunda-zeebe-8.6< 8.6.39-r13
camunda-zeebe-8.7< 8.7.41-r1
camunda-zeebe-8.8< 8.8.39-r1
cassandra-fips-4.0< 4.0.21-r2
cassandra-fips-4.1< 4.1.12-r2
cassandra-fips-5.0< 5.0.8-r15
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
conductor< 3.32.4-r1
druid< 37.0.0-r57
eco-java-gradle-7.6.5All versions (No fix recorded)
eco-java-gradle-7.6.6All versions (No fix recorded)
eco-java-gradle-8.10All versions (No fix recorded)
eco-java-gradle-8.10.1All versions (No fix recorded)
eco-java-gradle-8.10.2All versions (No fix recorded)
eco-java-gradle-8.1.1All versions (No fix recorded)
eco-java-gradle-8.11.1All versions (No fix recorded)
eco-java-gradle-8.12All versions (No fix recorded)
eco-java-gradle-8.12.1All versions (No fix recorded)
eco-java-gradle-8.13All versions (No fix recorded)
eco-java-gradle-8.14All versions (No fix recorded)
eco-java-gradle-8.14.1All versions (No fix recorded)
eco-java-gradle-8.14.2All versions (No fix recorded)
eco-java-gradle-8.14.3All versions (No fix recorded)
eco-java-gradle-8.14.4All versions (No fix recorded)
eco-java-gradle-8.14.5All versions (No fix recorded)
eco-java-gradle-8.8All versions (No fix recorded)
eco-java-gradle-8.9All versions (No fix recorded)
eco-java-gradle-9.0.0All versions (No fix recorded)
eco-java-gradle-9.1.0All versions (No fix recorded)
eco-java-gradle-9.2.0All versions (No fix recorded)
eco-java-gradle-9.2.1All versions (No fix recorded)
eco-java-gradle-9.3.0All versions (No fix recorded)
eco-java-gradle-9.3.1All versions (No fix recorded)
eco-java-gradle-9.4.0All versions (No fix recorded)
eco-java-gradle-9.4.1All versions (No fix recorded)
eco-java-gradle-9.5.0All versions (No fix recorded)
eco-java-gradle-9.5.1All versions (No fix recorded)
eco-java-gradle-9.6.0All versions (No fix recorded)
eco-java-gradle-9.6.1All versions (No fix recorded)
eco-java-gradle-9.7.0All versions (No fix recorded)
elasticsearch-9.2All versions (No fix recorded) | < 9.2.8-r15
elasticsearch-9.3All versions (No fix recorded)
geoserver-2.27< 2.27.6-r2
geoserver-2.28< 2.28.5-r2
geoserver-3.0< 3.0.1-r4
ghidra< 12.1.4-r1
guacamole-client-extensions< 1.6.0-r17 | < 1.6.0-r16
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r16
hono-adapter-mqtt< 2.7.0-r41
jenkins-2.541All versions (No fix recorded)
jenkins-2.541-openjdk-17All versions (No fix recorded)
jenkins-2.541-openjdk-21All versions (No fix recorded)
jenkins-2.541-openjdk-25All versions (No fix recorded)
jenkins-2.555All versions (No fix recorded)
jenkins-2.555-openjdk-21All versions (No fix recorded)
jenkins-2.555-openjdk-25All versions (No fix recorded)
jenkins-2.568< 2.568.3-r1
jenkins-2.568-openjdk-21< 2.568.3-r1
jenkins-2.568-openjdk-25< 2.568.3-r1
kayenta-2025.2< 2025.2.4-r11
kayenta-2025.4< 2025.4.6-r16
kayenta-2026.0< 2026.0.7-r5
kayenta-2026.1< 2026.1.2-r7
kayenta-2026.2< 2026.2.5-r3
kayenta-fips-2025.2All versions (No fix recorded) | < 2025.2.4-r11
kayenta-fips-2025.4< 2025.4.6-r9
kayenta-fips-2026.0< 2026.0.5-r5
kayenta-fips-2026.1< 2026.1.2-r7
kayenta-fips-2026.2< 2026.2.5-r3
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.6< 26.6.7-r1
keycloak-26.6-iamguarded-compat< 26.6.7-r1
keycloak-26.7< 26.7.4-r1
keycloak-26.7-iamguarded-compat< 26.7.4-r1
keycloak-fips-26.6< 26.6.7-r1
keycloak-fips-26.6-iamguarded-fips< 26.6.7-r1
keycloak-fips-26.7< 26.7.4-r1
keycloak-fips-26.7-iamguarded-fips< 26.7.4-r1
kserve-modelmesh< 0.12.0-r40
logstash-8.19< 8.19.21-r6
logstash-8.19-iamguarded-compat< 8.19.21-r6
logstash-8.19-with-output-opensearch< 8.19.21-r6
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4All versions (No fix recorded) | < 9.4.8-r0
logstash-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.8-r0
logstash-9.5All versions (No fix recorded) | < 9.5.5-r0
logstash-9.5-iamguarded-compatAll versions (No fix recorded) | < 9.5.5-r0
logstash-fips-9.4All versions (No fix recorded) | < 9.4.7-r6
logstash-fips-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.7-r6
logstash-fips-9.5All versions (No fix recorded) | < 9.5.4-r9
logstash-fips-9.5-iamguarded-compatAll versions (No fix recorded) | < 9.5.4-r8 | < 9.5.4-r9
nacos< 3.2.4-r2
nacos-docker< 3.2.4-r2
nuxeo-2023< 2023.45-r16
nuxeo-2025< 2025.20-r1
opensearch-2< 2.19.6-r11
opensearch-2-identity-shiro< 2.19.6-r12
opensearch-2-ingest-attachment< 2.19.6-r12
opensearch-2-ml-commons< 2.19.6-r11
opensearch-2-performance-analyzer< 2.19.6-r12
opensearch-2-security< 2.19.6-r12
opensearch-2-sql< 2.19.6-r12
pinotAll versions (No fix recorded)
pinot-fipsAll versions (No fix recorded)
ranger< 2.9.0-r6
request-9047-keycloak-fips-26.5< 26.5.7-r28
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r28
request-9047-keycloak-fips-26.6< 26.6.7-r1
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.7-r1
request-9047-keycloak-fips-26.7-iamguarded-fips< 26.7.4-r1
ruby3.2-bouncy-castle-java< 1.5.0146.1-r9
ruby3.3-bouncy-castle-java< 1.5.0146.1-r7
ruby3.4-bouncy-castle-java< 1.5.0146.1-r8
ruby4.0-bouncy-castle-java< 1.5.0146.1-r5
spark-4.0-scala-2.13< 4.0.4-r5
wazuh-indexer< 4.14.7-r6
wazuh-indexer-plugin-ml-commons< 4.14.7-r6
wazuh-indexer-plugin-performance-analyzer< 4.14.7-r6
wazuh-indexer-plugin-security< 4.14.7-r6
wazuh-indexer-plugin-sql< 4.14.7-r6
wso2is< 7.3.0-r4
zipkin< 3.6.1-r28 | All versions (No fix recorded)
zipkin-slimAll versions (No fix recorded) | < 3.6.1-r28

Show all 142

Wolfi19 products

apache-pulsar-4.2< 4.2.4-r5
druid< 37.0.0-r57
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.6< 26.6.7-r1

Show all 19

Org.bouncycastle4 products

bc-fips< 1.0.2.7 | ≥ 2.0.0, < 2.0.2 | ≥ 2.1.0, < 2.1.3
bcprov-jdk15to18< 1.85
bcprov-jdk18on< 1.85
bcprov-lts8on< 2.73.12

Bouncycastle3 products

bc-java< 1.85
bouncy_castle_for_java_lts≤ 2.73.11
fips_java_api≥ 1.0.0, < 1.0.2.7 | ≥ 2.0.0, < 2.0.2 | ≥ 2.1.0, < 2.1.3

Legion of the bouncy castle inc.3 products

bc-fja≥ 1.0.0, < 1.0.2.7 | ≥ 2.0.0, < 2.0.2 | ≥ 2.1.0, < 2.1.3
bc-java< 1.85
bc-lts-java≥ 2.73.0, < 2.73.12

Debian1 product

bouncycastleAll versions (No fix recorded) | < 1.86-1

Ubuntu1 product

bouncycastleAll versions (No fix recorded)

7 vendors · 173 products

References

13 links

github.com/bcgit/bc-java/wiki/CVE-2026-13506Vendor AdvisoryREPORTAdvisoryWEBThird Party Advisory
github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84PatchREPORTFIXWEB
ubuntu.com/security/CVE-2026-13506REPORT
www.cve.org/CVERecord?id=CVE-2026-13506REPORT
github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013506REPORT
security-tracker.debian.org/tracker/CVE-2026-13506Advisory
www.bouncycastle.org/download/bouncy-castle-java-fips/WEB
www.bouncycastle.org/download/bouncy-castle-java-lts/WEB
www.bouncycastle.org/download/bouncy-castle-java/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13506.jsonAdvisory

Show all 13 references

nvd.nist.gov/vuln/detail/CVE-2026-13506Advisory
github.com/bcgit/bc-javaPACKAGE
github.com/bcgit/bc-lts-javaPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities