{"id":"CVE-2026-13586","summary":"PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)","details":"In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).","modified":"2026-08-14T18:56:40.501274590Z","published":"2026-08-03T02:58:00.982Z","related":["SUSE-SU-2026:23127-1","SUSE-SU-2026:23150-1","SUSE-SU-2026:3559-1","openSUSE-SU-2026:11445-1","openSUSE-SU-2026:21538-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13586.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.0.2.7"},{"introduced":"2.0.0"},{"fixed":"2.0.2"},{"introduced":"2.1.0"},{"fixed":"2.1.3"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"bcorg","cwe_ids":["CWE-770"]},"references":[{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13586.json"},{"type":"ADVISORY","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013586"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13586"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-lts-java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bcgit/bc-java","events":[{"introduced":"0"},{"fixed":"57fbd3c501f7a369f64eda311d6a709fc0bcae84"},{"fixed":"75d60dfb4ca72bea6da96234138bc9b1556ef5b0"},{"fixed":"fa59cc23502f73def89d94374540cc92af647b96"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.85"}]}},{"type":"GIT","repo":"https://github.com/bcgit/bc-lts-java","events":[{"introduced":"468b5082f3f0971e80bf9edb7029c17b39b9ba0c"},{"fixed":"f101b232c5d3e07ecdd504210a57e43831d6cd65"}],"database_specific":{"extracted_events":[{"introduced":"2.73.0"},{"fixed":"2.73.12"}],"source":"AFFECTED_FIELD"}}],"versions":["r1rv84","r1rv81","r1rv83","r1rv82","r1rv80","r1rv78","r1rv77","r1rv76","r1rv75","r1rv74","r1rv73","r2rv73dot11","r2rv73dot10","r2rv73dot9","r2rv73dot8","r2rv73dot6","r2rv73dot4","r2rv73dot3","r2rv73dot1","r2rv73dot0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13586.json","vanir_signatures_modified":"2026-08-12T15:33:35Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"wrapKey"},"deprecated":false,"digest":{"function_hash":"260422492601392403562186346117797932263","length":546},"id":"CVE-2026-13586-002188ea"},{"source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"pkix/src/test/java/org/bouncycastle/pkcs/test/AllTests.java"},"deprecated":false,"digest":{"line_hashes":["79946982070285445374146250650913377811","179650968490506108345729476789349654949","145458289212498206683604737907471121625","64539651368602189613995280308136960006"],"threshold":0.9},"id":"CVE-2026-13586-0b8838d2","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"},"deprecated":false,"digest":{"line_hashes":["41001149971566920926172422598611415487","190390693420381772366899824561155703678","98845164067063405772417991984847345528","298433849928867912908642892087896757851","288796012701121643534871550001087026019","46689199092432997951304373066538356092","89654090213433072731233499193242700974","312861514196008427953606718599410302641","197698069387627634985875492644896959315","70564933956531417971950257563964483679","96053171010948502306421932903622191833","126629371974147410272569159588625389849","174199159503475410460053114325234450962","159536111004758318032223378320539176439","321624950595252441607362734170894228799"],"threshold":0.9},"id":"CVE-2026-13586-18b86019","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-13586-21147fa9","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"function":"convertToDefiniteLength","file":"prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"},"deprecated":false,"digest":{"function_hash":"286055730897453174432320262728240234611","length":930}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"function":"validateIterationCount","file":"prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"},"deprecated":false,"digest":{"function_hash":"58365957664759198879275180690962078769","length":516},"id":"CVE-2026-13586-2493261f"},{"id":"CVE-2026-13586-2d3244b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PKCS12StoreTest.java"},"deprecated":false,"digest":{"line_hashes":["57781819148775813988960117581989844656","58036982787995010768157555839774516389","57678703734170259786133521115930766716","41327067346447060560149062605282196159","117738975282177731720183743564240100192","86230013864835074102610615668165724476","291685336211696785872641138446001029103","143034907817536538742623279666141777718"],"threshold":0.9}},{"target":{"file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PKCS12StoreTest.java","function":"testIterationCount"},"deprecated":false,"digest":{"function_hash":"172792747652889504919481677741929593238","length":463},"id":"CVE-2026-13586-33920d51","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0"},{"digest":{"line_hashes":["130717456779628290799319971052627511767","322418715518905224148143360855442719421","111086614440389160754349079363144958334","251860252208781725316875861082912946993","64275336164675590167317642411364081752","14660861311978991637606164755265419658"],"threshold":0.9},"id":"CVE-2026-13586-39a26c47","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java"},"deprecated":false},{"id":"CVE-2026-13586-40e82781","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"prov/src/main/java/org/bouncycastle/jce/PKCS12Util.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["151179342390068528947256326612171572473","293795048864860963425209777415703147505","115147192350017007440785523846095472198","179554346487941832942413908254307429952","279271448171997901545391798711431608408","240090870655493558604203554986123636543","143523729449738210447622070784428507092","79755429581127719180493161911797512773","92095536127134500494031048208547605929","264131394820676579787227694404821935169","154370900486336087229587842721143970450"]}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java","function":"unwrapKey"},"deprecated":false,"digest":{"function_hash":"60233060954462720211381643716690262486","length":1131},"id":"CVE-2026-13586-51a1461d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false,"digest":{"line_hashes":["15650509136633268867029493405596642247","227534459320179647701683873883803837304","71179469984323401089659484245823125068","229227395035598765600064513616912218319","306029829301017755223220592868683344196","204527920320668335291236870675500326260","78256143013997344661556856569173490409","23335947030539593210977585011008101248","37458143115277431710122611788528433915"],"threshold":0.9},"id":"CVE-2026-13586-6235e0ac"},{"target":{"function":"cryptData","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false,"digest":{"function_hash":"159690551868197960726744589442781624402","length":1082},"id":"CVE-2026-13586-6cdc258c","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"},{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["186267376115903364161411840572558251985","186614312106326646816920241465895542631","221120964458291626795167932479908211293","275830356417188533252641407657651788768","270218167468528634434691442713138391775","198940029424508078572440411175544479467","100592550277153479900560485041465773254","107553554929838010740298771409195753299","203338385865972582371335440685867743462","128086724510568589507423273138909535729","119333703086741099737182090765603630466","93973905555515000199249510521519565321","208396192308354091077788005293890669977","311772047338465315272424520962557666664","327124414811670576514194755936746409171","257048045848677049050505552714157391068","49254691501117575229969552818390783668","119771261517632398768694931105263379870","317927588361279682485634066879971875636","295819596676669900034606820134177073093","205321377526250594047484323124337500842","123308104456545247788180282490936508122","231186937069744724619693748173531300428","289720173910302058970332420600698664011","295014962174494862872642169295092346607","303783603005723667043485208396720639642","211265271394268614071701412810252427378","77053077633367560711092385240446794401","190393130149868586934603915656788167379","309140075013886866363850966866134934721","175181431784148470477459107558890167204","330243716742639974347751739972842759667","294217964546357093081160642003885324840","266044547332714625868079852680276147431","67354180704815360213628625979449937085","175692723456558492451769326069653613131","191689455484828277718995307378487462058","308794137792613564776022329912718381768","242175138703892252163742447061410442056","230174568875680997735658060246143321759","330837984345337234066173445908700981695","177847441051607181338372963963312370839","197978004139751473205214522304045275430","79832297816223048015604016824572237095","320077132895002814259988282438781302511","103020380501349872512924345579020806624","69018421287854072595061998164338807947","236547675343145943181538354309409111099","127111734054559714967648608900847403015","211601684207564780056580125922272999520","42318915853577061003633144088761641246","303597983800682589197997361011603778284","13110806998893626838480489771906972101","150543915750858159598496691852742417315","205605652308111586549537427977721999130","100319644078267214837368760618091605546","316608026583348886568770007000726371718","127867363184847686115953433324652442023","143169495143164690536758284726745117664","155018470219325109631894984771889241634","138163910965300236136401161206903735542","141800620852228603329831116705821511922","209567004073084408918386233892666789465","24638869168397144488517348989416597460","258270239185139516247935102615460742153","174976771785859199351585760380451925891","3269041531278583164209670663009968739","180018730530207961179690335094871309440","29112516508699203861611327428513999307"]},"id":"CVE-2026-13586-70db74c5","signature_type":"Line"},{"digest":{"function_hash":"160006464268051548589183745060655853009","length":6385},"id":"CVE-2026-13586-878b0d7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java","function":"engineLoad"},"deprecated":false},{"source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"},"deprecated":false,"digest":{"line_hashes":["80131999752521269621094373818065807089","235247414574371671360904968103883342654","71179469984323401089659484245823125068","229227395035598765600064513616912218319","71411323181059277032491098005985236354","78256143013997344661556856569173490409","23335947030539593210977585011008101248","37458143115277431710122611788528433915"],"threshold":0.9},"id":"CVE-2026-13586-878e1de5","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"146185488275992488887332358375286785687","length":1569},"id":"CVE-2026-13586-9300be14","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"function":"createCipher","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0","target":{"file":"pkix/src/test/java/org/bouncycastle/pkcs/test/AllTests.java","function":"suite"},"deprecated":false,"digest":{"function_hash":"194860580165028437170906840973268183556","length":228},"id":"CVE-2026-13586-9e7e1d0b"},{"target":{"function":"unwrapKey","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"},"deprecated":false,"digest":{"function_hash":"60233060954462720211381643716690262486","length":1131},"id":"CVE-2026-13586-aa9648b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"},{"deprecated":false,"digest":{"function_hash":"260422492601392403562186346117797932263","length":546},"id":"CVE-2026-13586-ad1829d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"function":"wrapKey","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"}},{"source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"validateIterationCount"},"deprecated":false,"digest":{"function_hash":"116221452488317856134917323005502106492","length":413},"id":"CVE-2026-13586-bbd79c51","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"function":"calculatePbeMac","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false,"digest":{"length":1991,"function_hash":"93375355927373822278453117652364768883"},"id":"CVE-2026-13586-c4bbc0fb","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"121702520498743548110237886020351221027","length":765},"id":"CVE-2026-13586-c678e842","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"wrapKey"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"calculatePbeMac"},"deprecated":false,"digest":{"function_hash":"206748540790074696337505260012348881304","length":1551},"id":"CVE-2026-13586-c7ae20f9"},{"target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"cryptData"},"deprecated":false,"digest":{"function_hash":"159690551868197960726744589442781624402","length":1082},"id":"CVE-2026-13586-d599400a","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"},{"target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java","function":"validateIterationCount"},"deprecated":false,"digest":{"function_hash":"116221452488317856134917323005502106492","length":413},"id":"CVE-2026-13586-d9245bbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96"},{"digest":{"line_hashes":["186267376115903364161411840572558251985","296066507252470120857135363768847807999","290093104057884090090474193609121918561","205918715542660857782771208013955742816","203338385865972582371335440685867743462","128086724510568589507423273138909535729","119333703086741099737182090765603630466","93973905555515000199249510521519565321","208396192308354091077788005293890669977","311772047338465315272424520962557666664","327124414811670576514194755936746409171","257048045848677049050505552714157391068","49254691501117575229969552818390783668","119771261517632398768694931105263379870","317927588361279682485634066879971875636","295819596676669900034606820134177073093","295014962174494862872642169295092346607","303783603005723667043485208396720639642","211265271394268614071701412810252427378","77053077633367560711092385240446794401","190393130149868586934603915656788167379","309140075013886866363850966866134934721","175181431784148470477459107558890167204","219362836210687277728331793336107334205","329313061056581148003462803825968205549","155355858991820424638986758364333888002","58727660367401372577776130517093109458","61160657492518341801213690588455410814","250856427967907284945929896316294199984","297438165167804991066600862768054515323","318047407856471509670282872128808013611","338960050301613200318359531028625148086","334706030641651553261034467895394168234","49596540536659556908514128872969795928","247851895956743132288286212747620836151","265756991474920976443745343234199753018","333074141710635353878506192750459148821","175692723456558492451769326069653613131","191689455484828277718995307378487462058","308794137792613564776022329912718381768","242175138703892252163742447061410442056","330837984345337234066173445908700981695","177847441051607181338372963963312370839","197978004139751473205214522304045275430","79832297816223048015604016824572237095","320077132895002814259988282438781302511","103020380501349872512924345579020806624","69018421287854072595061998164338807947","236547675343145943181538354309409111099","127111734054559714967648608900847403015","211601684207564780056580125922272999520","42318915853577061003633144088761641246","303597983800682589197997361011603778284","13110806998893626838480489771906972101","150543915750858159598496691852742417315","205605652308111586549537427977721999130","100319644078267214837368760618091605546","316608026583348886568770007000726371718","127867363184847686115953433324652442023","143169495143164690536758284726745117664","155018470219325109631894984771889241634","138163910965300236136401161206903735542","141800620852228603329831116705821511922","209567004073084408918386233892666789465","24638869168397144488517348989416597460","258270239185139516247935102615460742153","174976771785859199351585760380451925891","3269041531278583164209670663009968739","180018730530207961179690335094871309440","29112516508699203861611327428513999307"],"threshold":0.9},"id":"CVE-2026-13586-de56c1a4","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false},{"digest":{"length":6342,"function_hash":"322539889662986565240740998327060816010"},"id":"CVE-2026-13586-f807be16","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"engineLoad"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/fa59cc23502f73def89d94374540cc92af647b96","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java","function":"createCipher"},"deprecated":false,"digest":{"function_hash":"78695185909752481092397783647944872932","length":2005},"id":"CVE-2026-13586-f9399188"},{"target":{"file":"core/src/main/java/org/bouncycastle/util/Properties.java"},"deprecated":false,"digest":{"line_hashes":["224857865166323732974720216857961116073","76122832230332266770156834571286201058","233562828850542885918997873421632220258"],"threshold":0.9},"id":"CVE-2026-13586-fb565e6a","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/75d60dfb4ca72bea6da96234138bc9b1556ef5b0"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber"}]}