Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-14682: Bouncy Castle Java may run out of memory

CVE-2026-14682 · published 3 months ago

Summary

Older versions of Bouncy Castle for Java can try to reserve a large amount of memory when processing certain data, which could cause the application to stop working. This affects the listed Bouncy Castle Java libraries in the versions mentioned. Update the libraries to the current releases to avoid the risk.

What to do

Update legion of the bouncy castle inc. bc-java to version 1.85 or later.
Update legion of the bouncy castle inc. bc-lts-java to version 2.73.12 or later.
Update bouncycastle bc-java to version 1.85 or later.
Update bouncycastle bctls-fips to version 1.0.24 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	legion of the bouncy castle inc.	bc-java	< 1.85
–	legion of the bouncy castle inc.	bc-lts-java	< 2.73.12
–	legion of the bouncy castle inc.	bc-fja	< 1.0.2.7 < 1.0.24
Debian:11	debian	bouncycastle	All versions
Debian:12	debian	bouncycastle	All versions
Debian:13	debian	bouncycastle	All versions
Debian:14	debian	bouncycastle	All versions
Ubuntu:Pro:16.04:LTS	canonical	bouncycastle	All versions
Ubuntu:Pro:18.04:LTS	canonical	bouncycastle	All versions
Ubuntu:Pro:20.04:LTS	canonical	bouncycastle	All versions
Ubuntu:Pro:22.04:LTS	canonical	bouncycastle	All versions
Ubuntu:Pro:24.04:LTS	canonical	bouncycastle	All versions
Ubuntu:26.04:LTS	canonical	bouncycastle	All versions
–	bouncycastle	bc-java	< 1.85 `cpe:2.3:a:bouncycastle:bc-java::::::::`
–	bouncycastle	bctls-fips	< 1.0.24 `cpe:2.3:a:bouncycastle:bctls-fips::::::::`
–	bouncycastle	bouncy_castle_for_java_lts	<= 2.73.11 `cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts::::::::`
–	bouncycastle	fips_java_api	>= 1.0.0, < 1.0.2.7 >= 2.0.0, < 2.0.2 >= 2.1.0, < 2.1.3 `cpe:2.3:a:bouncycastle:fips_java_api::::::::`

Original advisory text

Possible OOM from unbounded up-front allocation on a definite-length read

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24.

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9014682 Vendor Advisory
https://github.com/bcgit/bc-java/wiki/CVE-2026-14682
https://security-tracker.debian.org/tracker/CVE-2026-14682 Vendor Advisory
https://www.bouncycastle.org/download/bouncy-castle-java-lts/ URL
https://www.bouncycastle.org/download/bouncy-castle-java/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14682... Vendor Advisory
https://www.bouncycastle.org/download/bouncy-castle-java-fips/ URL
https://ubuntu.com/security/CVE-2026-14682 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-14682 Third Party Advisory
https://github.com/bcgit/bc-java/commit/37094e504ef50cf9ce4e0fb9e5105d495ff5c2d2 Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-14682 Vendor Advisory
https://github.com/bcgit/bc-java Product
https://github.com/bcgit/bc-lts-java Product

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-789Memory Allocation with Excessive Size Value

Timeline

Published3 Aug 2026

Updated4 Nov 2026

First seen3 Aug 2026

Sources

CVE-2026-14682 · OSV

CVE-2026-14682 · NVD

CVE-2026-14682 · MITRE

DEBIAN-CVE-2026-14682 · OSV

UBUNTU-CVE-2026-14682 · OSV

Track software like this

Free during beta