{"id":"CVE-2026-17508","summary":"Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points","details":"In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).","modified":"2026-10-22T16:31:47.676193109Z","published":"2026-10-02T07:27:59.519Z","related":["SUSE-SU-2026:4797-1","openSUSE-SU-2026:12090-1"],"database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17508.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.0.0"},{"fixed":"1.0.13"},{"introduced":"2.0.0"},{"fixed":"2.0.13"},{"introduced":"2.1.0"},{"fixed":"2.1.13"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"bcorg"},"references":[{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17508.json"},{"type":"ADVISORY","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9017508"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17508"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-lts-java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bcgit/bc-java","events":[{"introduced":"0"},{"fixed":"eacda831fbe15b272933e40841d8b0827b556fae"},{"fixed":"882fdab53f6c4c150a5d6a4e6ef1fc05d382385a"},{"fixed":"442393bf187c914b1e66fbed4fab532a1fe06c6a"},{"fixed":"20ed9e203caec91d25cd386ceb6d364e9b068f67"},{"fixed":"766a31026ac24ed3c6cad8662058ba450c338da1"},{"fixed":"e72bc0681ff4227fced912ef7394daf7b7d57bb3"},{"fixed":"480d878aa6f7dc8b20403064f304bbe0decbbb1a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.86"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"882fdab53f6c4c150a5d6a4e6ef1fc05d382385a"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"442393bf187c914b1e66fbed4fab532a1fe06c6a"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"20ed9e203caec91d25cd386ceb6d364e9b068f67"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"766a31026ac24ed3c6cad8662058ba450c338da1"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"e72bc0681ff4227fced912ef7394daf7b7d57bb3"}]},{"range":[{"fixed":"480d878aa6f7dc8b20403064f304bbe0decbbb1a"}],"source":"REFERENCES_COMMIT"}]}},{"type":"GIT","repo":"https://github.com/bcgit/bc-lts-java","events":[{"introduced":"468b5082f3f0971e80bf9edb7029c17b39b9ba0c"},{"fixed":"43d27611d3b82e54050d1def60b516f8295e485b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.73.0"},{"fixed":"2.73.13"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["r1rv73","r2rv73dot12dot1","r2rv73dot12","r2rv73dot11","r2rv73dot10","r2rv73dot9","r2rv73dot8","r2rv73dot6","r2rv73dot4","r2rv73dot3","r2rv73dot1","r2rv73dot0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-17508.json","vanir_signatures":[{"target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java","function":"engineGenerateSecret"},"deprecated":false,"digest":{"function_hash":"283110061590036587346140784364806476776","length":1232},"id":"CVE-2026-17508-0a1e3d25","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1"},{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"function":"calculatePBMAC1","file":"pkix/src/main/java/org/bouncycastle/pkcs/util/PKCS12Util.java"},"deprecated":false,"digest":{"function_hash":"3532462878738421948164858213095046500","length":1235},"id":"CVE-2026-17508-0b4eebfb","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["138181247408899040249400018688599970935","157076650123742976017600283311648688772","299831574497901735587913555181378186651","119656624553792833336683544475511307167","285360667363707167858519504783424612322"]},"id":"CVE-2026-17508-0d8eac13","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b","target":{"file":"tls/src/main/java/org/bouncycastle/jsse/provider/BouncyCastleJsseProvider.java"},"deprecated":false},{"deprecated":false,"digest":{"length":1587,"function_hash":"63319963188403829209068449128093887435"},"id":"CVE-2026-17508-251e0655","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"calculatePbeMac"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java","function":"wrapKey"},"deprecated":false,"digest":{"length":780,"function_hash":"155019029517872758948943640080858056963"},"id":"CVE-2026-17508-29dac85f"},{"source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false,"digest":{"line_hashes":["177372076277804437512899947210065627078","15048866475006312922981258517278481356","22078776289913616242838906691542453056","248814392144302448595496370577364238842"],"threshold":0.9},"id":"CVE-2026-17508-2a79e8ea","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["198998642969818417039950766575124474122","176485554327561807626586916754186965744","30122234930542453359703034466236659062","145259701364354400312802743171023262636"],"threshold":0.9},"id":"CVE-2026-17508-2bd8f355","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b","target":{"file":"core/src/main/java/org/bouncycastle/crypto/CryptoServicesRegistrar.java"}},{"deprecated":false,"digest":{"function_hash":"92990237564067571128614587685345852577","length":4437},"id":"CVE-2026-17508-2f9e43f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1","target":{"function":"performTest","file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PBETest.java"}},{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java","function":"createPBMac1Calculator"},"deprecated":false,"digest":{"function_hash":"244745747811695624857402889631808812229","length":962},"id":"CVE-2026-17508-386eb3cd","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["134902664215026488269659596688903720364","321494922550655676952259179890383081274","217078069302867107462901331274123897729","293960044425652652591741690912802394992","259374364529406847406173160088458655021","272849904686859689384915313250555479056","164123936555443215830704205402857699178","146220011011113328214267649677391866772","284772396699507661284043632718803632774","110205475660799871836905570035032413971","56071328906626365426443586358241819754","149856882257116249034692839616809467717","241406231014599686536294786522080062270"]},"id":"CVE-2026-17508-3b933a7f","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePBMac1CalculatorBuilder.java"},"deprecated":false,"digest":{"line_hashes":["153466990862143956830728538826340073704","210892785238532880238625028160545013800","233236525985106636224995955227067511713","210868507209189839146596226719779630199","8360403756567106919202635173480009716","2351170751805005132173375205833613020","275127154265805873452987481850280636094","70208624790161346476788624317741465020"],"threshold":0.9},"id":"CVE-2026-17508-3d4b2726"},{"id":"CVE-2026-17508-3e15219a","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b","target":{"file":"prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107492299239844656455992969154194751546","88031704519188679500783664866555175428","8719723814761448299496542886894605159","203626202713639004218273365189024195254"]}},{"deprecated":false,"digest":{"line_hashes":["8211181235356044565010721458359054079","334743777587131804541160416180084776948","179877466538714796600241055590233192740"],"threshold":0.9},"id":"CVE-2026-17508-48342561","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12Util.java"}},{"deprecated":false,"digest":{"line_hashes":["307860442614700439199040851585867362343","279150346697505203950309963335800561799","137290408825349102829031917334217422874","303786571307348167826831367606933390934","177372076277804437512899947210065627078","15048866475006312922981258517278481356","22078776289913616242838906691542453056","248814392144302448595496370577364238842"],"threshold":0.9},"id":"CVE-2026-17508-50025df1","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12KeyStoreSpi.java"}},{"source":"https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67","target":{"file":"pkix/src/main/java/org/bouncycastle/openssl/jcajce/JceOpenSSLPKCS8DecryptorProviderBuilder.java"},"deprecated":false,"digest":{"line_hashes":["139867803237396682641081466549758336153","308221974945910984033600577695600983508","135710472373338193186849335037018287695","126522775330737478726206029567721436164","25113821050651111864947385530584717470","198958448298138399197598378511954713568","50078579185754280997268693536544198120","45068795002974006330867991231356558146","185762335740824778451305652563137498647","113895930192366550830632676367506843565","131303093928442533608374907449067022448"],"threshold":0.9},"id":"CVE-2026-17508-692f2a99","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b","target":{"function":"BouncyCastleProvider","file":"prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java"},"deprecated":false,"digest":{"length":167,"function_hash":"15037932978976058678046096832551679440"},"id":"CVE-2026-17508-69554e16","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3","target":{"file":"core/src/main/java/org/bouncycastle/util/Properties.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["216178916484834625407626406325803398449","17715739628611453223766295590303368001","85616682715101955393045027577114077524"]},"id":"CVE-2026-17508-70fb5441","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java","function":"engineInit"},"deprecated":false,"digest":{"length":133,"function_hash":"327069873105463730607406971638290175233"},"id":"CVE-2026-17508-74c7dc30","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["124363420934960697109055482382257769524","181486092088674459121436007917360830492","90223259664771688824804326707367408907","245714155879004258813282839552257861254","229227945700071131397834021049953495296","305046736122872946742997289374650429888","248814392144302448595496370577364238842"],"threshold":0.9},"id":"CVE-2026-17508-82550af7","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/util/PKCS12Util.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePBMac1CalculatorBuilder.java","function":"build"},"deprecated":false,"digest":{"length":1461,"function_hash":"289503176771193056709936743169829097826"},"id":"CVE-2026-17508-8a389ffc"},{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/bc/PKCS12PBEUtils.java"},"deprecated":false,"digest":{"line_hashes":["12613510752962270572759754650572988992","75418705673854299014871424648533290037","256793528079807414556707092093018039664","190884975884083543966345398492896660870","177372076277804437512899947210065627078","338665435692295360757516559898364705284","80170726212568837937195101355155615762","110010011176840908427439695410389965883"],"threshold":0.9},"id":"CVE-2026-17508-8a854f70","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["242709525740693464710427490155770468404","248642779262357672847364455182716518927","61814954006545347336174517664014600025","330018612005703343214037579938126279111","242829773328378005944812852432809826984","79254956226836762206179235050231922419","209487308353917155254006337248362131884","106210232137615890613524585425523676440","18549171508569019471478065680037232028","89074046693925405438872018885514326583","41518768961989073683430800842658785826"],"threshold":0.9},"id":"CVE-2026-17508-8aad8c12","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3","target":{"file":"core/src/test/java/org/bouncycastle/crypto/test/OpenSSHKeyParsingTests.java"}},{"source":"https://github.com/bcgit/bc-java/commit/480d878aa6f7dc8b20403064f304bbe0decbbb1a","target":{"file":"pkix/src/test/java/org/bouncycastle/pkcs/test/PfxPduTest.java"},"deprecated":false,"digest":{"line_hashes":["325308758955859088059217355439500741141","239865648952890385547258985686970835227","143891873480768506591726871039049435685"],"threshold":0.9},"id":"CVE-2026-17508-9623a688","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3","target":{"file":"core/src/main/java/org/bouncycastle/crypto/util/OpenSSHPrivateKeyUtil.java"},"deprecated":false,"digest":{"line_hashes":["30437902715218948892537259822511053179","184373378579193858500056961183893769995","257797085308409003202193516822381393948","59551789984047946024383357433947736273","182113889247115181043375752956355345480","266503544064845017451436106007798517075","102432188003067764207645616102555648411"],"threshold":0.9},"id":"CVE-2026-17508-9f56ac21"},{"target":{"file":"core/src/main/java/org/bouncycastle/crypto/util/OpenSSHPrivateKeyUtil.java","function":"decryptOpenSSHV1"},"deprecated":false,"digest":{"function_hash":"296719704855993444941507456823150627078","length":2371},"id":"CVE-2026-17508-addc41b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3"},{"target":{"file":"prov/src/test/java/org/bouncycastle/jce/provider/test/BCFKSStoreTest.java"},"deprecated":false,"digest":{"line_hashes":["263231788446534084400473174623577175852","95237199885192598363211553346757310909","219387587931115958615432237730990949245","130247733194767326409842075146711308","280970611085530692133656523796269063701","64151451290514701110214790872123532347","278653812449156399570546490829005804677","2141221302420564606997591597181611262","54535801004284265464791551918498173940","280036114443425543801991002035779767100","12452297812687175470203374378364877774","298011660510322377549117364281775529009","323586452896178042008770795020826008454","248885161557171674979122244331868205158"],"threshold":0.9},"id":"CVE-2026-17508-ae8e4d5e","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a"},{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePKCSPBEInputDecryptorProviderBuilder.java","function":"checkScryptCost"},"deprecated":false,"digest":{"length":713,"function_hash":"40664250943978140959169425650395655686"},"id":"CVE-2026-17508-b15bb361","signature_type":"Function"},{"digest":{"function_hash":"40664250943978140959169425650395655686","length":713},"id":"CVE-2026-17508-bb53f466","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67","target":{"function":"checkScryptCost","file":"pkix/src/main/java/org/bouncycastle/openssl/jcajce/JceOpenSSLPKCS8DecryptorProviderBuilder.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["142371656489435841291433171748938768211","276114836867604848252227924564245563626","174725713112723821587285552842847152170","296396029911940671522003416275304613740","306388871444103436989662018391338496270","187304475125762585622491255445396488097","161374838074741889965706815960646264073"]},"id":"CVE-2026-17508-be411bea","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1","target":{"file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PBETest.java"}},{"source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java","function":"generateKey"},"deprecated":false,"digest":{"function_hash":"28483275931710038995848972429745695640","length":1909},"id":"CVE-2026-17508-c04560d7","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-17508-db1b856f","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"function":"calculatePbeMac","file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/pkcs12/PKCS12PBMAC1KeyStoreSpi.java"},"deprecated":false,"digest":{"function_hash":"144297674496070486364361882089719466188","length":1990}},{"digest":{"function_hash":"219729498584516135347313253161027034708","length":414},"id":"CVE-2026-17508-dbde2a1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a","target":{"function":"performTest","file":"prov/src/test/java/org/bouncycastle/jce/provider/test/BCFKSStoreTest.java"},"deprecated":false},{"target":{"file":"prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/bcfks/BcFKSKeyStoreSpi.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["169931635468607003376618791414613094911","74397421977926187762966918859114398122","243214200936403498328876083394014772123","291744629460853391573348941247192264418","113313564231216399987676023854883786284","325297496715787280598399275629719060464","87581935148775522401043082521698631590","190172883396378728093632585176996295869","215815260039460687782956113028593029634","276357864747365853053590127307232532421","157471025905011501688577818374383343462"]},"id":"CVE-2026-17508-e7f08ab6","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/442393bf187c914b1e66fbed4fab532a1fe06c6a"},{"source":"https://github.com/bcgit/bc-java/commit/20ed9e203caec91d25cd386ceb6d364e9b068f67","target":{"file":"pkix/src/main/java/org/bouncycastle/pkcs/jcajce/JcePKCSPBEInputDecryptorProviderBuilder.java"},"deprecated":false,"digest":{"line_hashes":["139867803237396682641081466549758336153","308221974945910984033600577695600983508","135710472373338193186849335037018287695","126522775330737478726206029567721436164","25113821050651111864947385530584717470","198958448298138399197598378511954713568","50078579185754280997268693536544198120","45068795002974006330867991231356558146","185762335740824778451305652563137498647","113895930192366550830632676367506843565","131303093928442533608374907449067022448"],"threshold":0.9},"id":"CVE-2026-17508-ec88d036","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/882fdab53f6c4c150a5d6a4e6ef1fc05d382385a","target":{"file":"pkix/src/test/java/org/bouncycastle/pkcs/test/PBETest.java"},"deprecated":false,"digest":{"line_hashes":["335932553205252043829837728149826599526"],"threshold":0.9},"id":"CVE-2026-17508-f74c818e"},{"digest":{"function_hash":"63939824639301362127446589712112635591","length":174},"id":"CVE-2026-17508-fc61aedd","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/e72bc0681ff4227fced912ef7394daf7b7d57bb3","target":{"file":"core/src/test/java/org/bouncycastle/crypto/test/OpenSSHKeyParsingTests.java","function":"performTest"},"deprecated":false}],"vanir_signatures_modified":"2026-10-22T16:31:47Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber"}]}