CVE-2026-3505

Aliases:GHSA-cj8j-37rh-8475DEBIAN-CVE-2026-3505CGA-2cfh-jjx8-56r5CGA-45qh-p88j-8hv7CGA-4hxx-jfq5-cf8fCGA-4m8c-8p5h-669rCGA-4q2m-m9rm-h4hgCGA-57cp-gfr6-jh24CGA-68fx-f3mx-7j5gCGA-89c4-c5gj-79vwCGA-cqmc-qg7f-9v3hCGA-fjhj-jr2v-x2rrCGA-fm33-vrjh-2fp7CGA-gv43-c89g-gfw8CGA-gvxq-c88w-5gfjCGA-m688-9926-xh7fCGA-mq3w-3prg-rmvvCGA-prjq-qxq8-83v7CGA-278w-5vxr-hwp7CGA-28m2-w99c-mghvCGA-2j9g-9m5f-2v3cCGA-2jhq-q85p-wjgcCGA-2v76-gf5v-m5p7CGA-39jx-5hgv-3f88CGA-3q6q-mq37-84rjCGA-3v86-ggjh-6fxgCGA-49hq-9vw7-fjvmCGA-4c23-8px9-39vhCGA-5q6v-5w9v-fffqCGA-624p-2wj9-842cCGA-649c-g4q4-rfq6CGA-652m-fc3h-r86vCGA-6624-2g22-jqf4CGA-6j5m-w8gp-93pcCGA-6v8q-7qmr-x24gCGA-6vx3-3rrx-h96jCGA-7299-m9jq-mj67CGA-7474-37c5-x79pCGA-75rr-69v2-5hxcCGA-7hq3-ghhc-4625CGA-7mf4-h3hv-rxm6CGA-7vhw-jwpj-pfw5CGA-8277-xjhc-8wxfCGA-86j6-ff52-hg8wCGA-8pv9-582f-v84cCGA-8q9c-j8vv-wfqcCGA-8r9w-hc7j-rr28CGA-8wjh-r29x-r9qmCGA-93hm-55mw-pxvjCGA-995x-52jm-m3p5CGA-9xvf-58vf-q4g3CGA-cgjf-vrwf-pjcgCGA-cpcm-4m26-mgwmCGA-cvfg-97qh-cw7gCGA-cvxf-q943-cv4cCGA-ggcx-6j88-46m3CGA-hxf3-g6pf-c74vCGA-hxjx-8254-7pwjCGA-j6fp-2g74-x743CGA-j789-vphf-56hwCGA-jv48-6w8x-7fv9CGA-m43r-mrrv-637vCGA-m9hw-3vqf-2gmmCGA-mcm4-qjmc-hfx4CGA-mfrx-2wm6-2773CGA-mmj7-7rx8-g566CGA-p2v2-86wp-m24fCGA-p86p-87vj-44m2CGA-pgvh-5ch8-mq4hCGA-pwv4-r6x9-836pCGA-pwv5-x4fh-g994CGA-q7m9-m3c2-8h4gCGA-qcpw-35rq-jc7hCGA-qhvm-w9xq-r3f8CGA-qj67-9g48-v8q9CGA-qm8x-v496-r4rqCGA-qrgp-vrm8-869xCGA-r25x-5c77-354xCGA-r566-4vm6-hg4pCGA-r722-4rx2-ggfgCGA-rhr4-j2j4-pwgwCGA-rp3g-3pgg-wfm2CGA-rrpf-fxf5-rv78CGA-v33m-3cj2-89q6CGA-v45x-m74j-5xm4CGA-v5m5-262p-6gp2CGA-v8g6-2f9f-mjjcCGA-vqxp-qcpr-x76qCGA-w96g-4wc8-hq9jCGA-wq8f-8vfx-g88gCGA-x86v-wm84-r747CGA-xcq5-xp58-8jqmCGA-xf2c-j5h8-c348CGA-xfhf-jw8g-qccpCGA-xh3q-vw6p-qgqhCGA-xv76-6538-2xq5CGA-xx54-h29r-w54vCGA-27wr-23c3-jrm2CGA-28xc-qhr7-49hgCGA-2mqp-crff-w8fhCGA-2q4m-2242-g6h5CGA-387v-3v3c-g96rCGA-3g2h-7fwm-79mwCGA-3jgg-2h9q-8rvrCGA-3p5w-cwhg-xjfvCGA-4hg9-545h-cc6hCGA-4vmp-qwf3-43x5CGA-5r35-54w5-f36rCGA-5wjg-f7cf-8wpxCGA-65rf-4qqg-rpvvCGA-67ww-7xqf-h74gCGA-6fgg-v2ww-w43qCGA-6pjr-fjp5-587wCGA-6r63-jfwh-4mvvCGA-6rgp-9vwh-cwwgCGA-7qpx-f35c-hjccCGA-84vr-g75q-6pmfCGA-8rfj-87g8-588pCGA-94x8-5xx3-3v25CGA-9pqh-vmjq-xp88CGA-c562-5pp2-h5mqCGA-c79j-8j8g-rhwfCGA-cf93-m6rx-r79xCGA-cgjw-864j-8768CGA-f928-vm99-8fppCGA-fm29-99fx-v68cCGA-g52p-xq76-q8qcCGA-g588-26g6-5f3gCGA-ggx2-xjpj-v3x9CGA-gm48-cgrq-9mvcCGA-gvm6-r2c3-9ch2CGA-h7p4-2h3r-85vmCGA-hm2j-5j8q-8285CGA-jwwx-hc5q-7qr6CGA-m3m8-pc9c-9qchCGA-m6rg-w6r5-v53pCGA-mpxr-gh78-h5gfCGA-pc24-jvf8-hjrpCGA-pmhf-63rj-c2qpCGA-q2g5-9822-m3ppCGA-q938-67jr-m6g6CGA-qmxw-gmrm-wwg2CGA-qp99-h6vw-7fhpCGA-qwjw-vh89-848rCGA-qxcc-m6p2-v7pfCGA-r46x-68w6-h8g3CGA-r6qr-6cmp-4fp5CGA-rw9h-gcj9-6643CGA-rxxp-v4v7-2w72CGA-v9fp-g2gc-9x93CGA-vjg7-qfwm-7qc9CGA-vq55-pmx9-3fr8CGA-w2wq-v685-p2qrCGA-x642-g238-95wcCGA-xq2g-54m2-q358CGA-2463-qwcf-h3xwCGA-2gjh-m4rg-2vfrCGA-2qhh-h2fh-4r96CGA-33mx-wwvp-grcjCGA-365x-2gv9-23g3CGA-37h2-h7h6-pp7xCGA-3999-2r4j-2wp7CGA-39gw-256r-qvjhCGA-3q22-x7gr-4842CGA-426p-695p-w55pCGA-442q-37v2-2xmwCGA-4626-69w5-m58pCGA-4727-w8h7-jj3pCGA-4765-rxq9-8662CGA-4929-6q29-7cgfCGA-4j35-phw8-5wgwCGA-4mpp-57m6-3q4pCGA-4p2v-gjrv-phwhCGA-4qfh-6jj9-8h86CGA-4vwg-934p-prr3CGA-4vxp-485c-fw26CGA-4w82-2xg3-c2q9CGA-52gc-fx6j-mmchCGA-5c85-q8hw-vggvCGA-5jm8-8rpm-26q3CGA-5v9g-v29c-r528CGA-5w95-p7h8-7v45CGA-69xv-wqxm-82fhCGA-6jq3-m8jj-4wq8CGA-6m8m-h623-wpp4CGA-77rq-f5h5-22rjCGA-7hhj-763v-jrchCGA-7r8p-qxhg-6v59CGA-7rc6-g849-fmq4CGA-8pvm-v54g-jh7xCGA-8vvw-x3fm-cvw6CGA-8wx8-mmh6-q7rqCGA-9448-mg9p-cxxfCGA-9p4v-pp7x-9hm6CGA-9q8q-5mp6-ww9rCGA-c3vg-6357-278qCGA-c4rh-f2j5-j7ffCGA-cw25-q26h-gc58CGA-f58c-497x-93r3CGA-fm5f-hfmg-jcvhCGA-fr64-22w6-2prqCGA-fvm3-7mh3-59jwCGA-fwp2-px7g-35vqCGA-g249-285h-wf8qCGA-g2hq-cwv3-5mvmCGA-gqrq-wvwm-65mcCGA-h558-gp9c-mh46CGA-h69f-553h-766cCGA-hfgf-xf8h-7wgmCGA-hg6w-mq63-c399CGA-hgp4-rc2v-3c8cCGA-hpjf-ghx7-3mv5CGA-hppj-6cmg-8h5qCGA-hr45-j26c-gg26CGA-j3qh-vcpp-cg96CGA-j42w-rpwp-6hp2CGA-j8hq-vv55-cchhCGA-jxx7-833g-3xhpCGA-m2vr-qx5j-gfrxCGA-m3fw-frhv-6jv5CGA-m7gc-9438-3fpwCGA-m8cp-hx9x-mqv2CGA-mxg2-vmhq-jv5hCGA-p7fg-rgcv-29rvCGA-phj5-pvx2-qw64CGA-pqcq-2vcp-mvcgCGA-q3fq-p6v4-2mfcCGA-qc38-45cx-84vxCGA-qx6w-7f4p-h7gwCGA-r5f4-644h-g7frCGA-r8m9-pq6x-g6f7CGA-r94r-vp9h-7p52CGA-rf4x-3243-86qvCGA-rhr6-xxc7-wpf2CGA-rhv2-9hhx-cg82CGA-rrqj-7mw8-rpfpCGA-rw8g-3m33-hgj4CGA-v2rw-8jpm-rpvvCGA-v6q9-7756-cw49CGA-vcrc-3c5c-2mc8CGA-vw5c-29pw-p3xpCGA-vw7w-332j-mm8qCGA-ww89-6fq6-3qgjCGA-wwwq-9396-44c5CGA-x256-233w-4f8cCGA-x2pf-5rpv-h4jmCGA-x472-w55j-7m8cCGA-x48f-jx6j-9f3wCGA-x49m-qvfr-rh3xCGA-x973-5g58-h7fgCGA-xm93-r6gq-p982CGA-xwxc-hhcg-c9fjCGA-22v4-w94v-23g4CGA-2j2r-hvjc-rqwpCGA-2rrv-9wp5-4x4rCGA-35qm-wqgp-9j85CGA-3p84-vhvp-72gmCGA-44pj-8p39-87p2CGA-4g8q-x962-gr8rCGA-4hrq-fw38-wmmxCGA-4jc8-xv9f-mf94CGA-57gw-wqfc-w7q2CGA-5qmp-hqp6-8gv9CGA-6mjj-gp8p-65j9CGA-6qq6-3rm8-rw2pCGA-7623-rm6f-vc42CGA-7c7v-jf74-8mxfCGA-7mjf-mjpq-xffxCGA-7pw9-xch9-f5fcCGA-7qr3-88w2-9r22CGA-8j8q-44vc-4vvpCGA-8phh-mv8v-r5cxCGA-8vf3-28wh-v4w2CGA-9599-3r6m-9qq8CGA-99x4-mrf6-qh2vCGA-9m2f-f5vc-mvx9CGA-9p3p-4r55-pphhCGA-9ph7-crq3-wxmpCGA-9q6g-q2r5-8cjpCGA-9rw4-rvqm-2rjgCGA-9xw5-993w-c96fCGA-c9qp-hmj6-q4w5CGA-ccpp-pcg5-wprxCGA-crc7-hmmr-w79fCGA-crr4-8c4w-mr8fCGA-cw2v-vwfc-rrvmCGA-f36f-7r8w-93j5CGA-f72r-p23h-74v6CGA-f887-8chx-m5chCGA-fgxm-8rm7-fjjgCGA-fr6j-793m-rxpcCGA-g6ch-vhvh-jx9pCGA-gf32-3rwf-jvjgCGA-gf57-9g9x-r766CGA-gv8w-xrv3-9prqCGA-h5x7-rvgc-j48hCGA-hvm7-9fxj-2wh5CGA-j7qf-vpj3-57p3CGA-jcpx-jp5x-7grgCGA-jgg7-68mq-pvfpCGA-m374-m7pc-4fg7CGA-m3p2-qwv7-g6gmCGA-m487-wp3h-f598CGA-m96m-r633-hgcmCGA-m99v-c9ph-xxw6CGA-mfj8-fhpf-gv6fCGA-p2hh-x44r-vpgxCGA-p6xq-2r26-f997CGA-pp5c-99x5-6jjfCGA-pv84-r2g3-22rcCGA-q499-23vg-vx4pCGA-q5p2-6x6p-84jhCGA-qgpv-53h3-638xCGA-qrp8-33r5-qfw6CGA-qvv8-j49h-x628CGA-rh4c-752m-4rpgCGA-rj77-cwrf-3r9xCGA-v28f-v7wj-94xxCGA-vgp4-f8fw-2c4cCGA-vgxx-vmp9-mw8rCGA-w4x9-rr34-7m8qCGA-w6jm-2979-8p4hCGA-wphx-mvj9-qwmmCGA-wq2w-pwp9-6c8jCGA-wvw6-g4vc-8x77CGA-wwq5-r556-crj2CGA-x575-8pv4-3pxhCGA-x8p4-mpx9-85hhCGA-xm9j-j2wc-6f7jCGA-xmr7-9frj-3437CGA-xpf9-94q8-7xq9
Advisory lineage Upstream: 0 Downstream: 8
Awaiting Analysis
Published: 15 Apr 2026, 09:06
Last modified:18 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.79% LOW
1% probability +0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2026, 09:06
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.79%• Percentile: 55%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•apache-nifi

    < 2.9.0-r1

  • chainguard•apache-nifi-registry

    < 2.9.0-r2

  • chainguard•apache-nifi-registry-toolkit

    < 2.9.0-r2

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

Showing first 50 affected entries in server-rendered view.

References (30)