{"id":"CVE-2026-59645","summary":"OER parser recurses without depth limit on self-referential IEEE 1609.2 schema","details":"In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).","modified":"2026-10-16T09:59:43.965405323Z","published":"2026-08-03T00:49:41.143Z","related":["SUSE-SU-2026:23127-1","SUSE-SU-2026:23150-1","SUSE-SU-2026:3559-1","openSUSE-SU-2026:11445-1","openSUSE-SU-2026:21538-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"2.0.0"},{"fixed":"2.0.7"},{"introduced":"2.1.0"},{"fixed":"2.1.7"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"bcorg","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59645.json"},"references":[{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59645.json"},{"type":"ADVISORY","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059645"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59645"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-lts-java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bcgit/bc-java","events":[{"introduced":"1ef1da015e116c1c2d09719674dfdd437971077f"},{"fixed":"57fbd3c501f7a369f64eda311d6a709fc0bcae84"},{"fixed":"822b2478b131097368a56290f5728e28dd042989"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.70"},{"fixed":"1.85"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"822b2478b131097368a56290f5728e28dd042989"}],"source":"REFERENCES_COMMIT"}]}},{"type":"GIT","repo":"https://github.com/bcgit/bc-lts-java","events":[{"introduced":"468b5082f3f0971e80bf9edb7029c17b39b9ba0c"},{"fixed":"f101b232c5d3e07ecdd504210a57e43831d6cd65"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.73.0"},{"fixed":"2.73.12"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"0"},{"last_affected":"2.73.11"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*"}]}}],"versions":["r2rv73dot11","r2rv73dot10","r2rv73dot9","r2rv73dot8","r2rv73dot6","r2rv73dot4","r2rv73dot3","r2rv73dot1","r2rv73dot0"],"database_specific":{"vanir_signatures":[{"target":{"file":"util/src/test/java/org/bouncycastle/oer/test/AllTests.java","function":"suite"},"deprecated":false,"digest":{"length":194,"function_hash":"61936957452251868043795347011950388770"},"id":"CVE-2026-59645-480cd609","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989","target":{"file":"util/src/main/java/org/bouncycastle/oer/OERInputStream.java"},"deprecated":false,"digest":{"line_hashes":["126596299296551308706069173584671460594","155076172052863575117192343166341235009","21836474561459979390668704730975039201","197623880350845315046584744138405013559","146625228997615351644760173160344521923","136251056313618512205121835712578705475","231420547814360522088607496756397463404","78199702252350390510963295229808185302","189318316724631994981851886335945560901","330979747661613284090515451343864728171","62818674120174673211493461531171871837","73168273366388733868076141176246148565","301937890632115766460903127849709419957","277113260795665366007155654937732960055","146702891423135798157360235099291420437","201153433670954445769645824934664358170","115685587466320056377554019118170517486","26937990677708113023436765806908363293","95125908845527997869754958781802113489","83418577537951949483446264076509504704","194539196534964886070491898142929828505","126124747591311759782218478905337563796","83845875165784887020180875240669614037","60030179346439282314043827242105660044","134205829938269904774197535387926818073","96574085834165875949643863414280446893","169367590695605967319382912482154978214","211428309378636244559928485805304368599","176971805541668147916752765084889732044","197988939767144981840775126193834364063","35630994645827930408971053902471673599"],"threshold":0.9},"id":"CVE-2026-59645-66a125b7"},{"deprecated":false,"digest":{"function_hash":"310239606002667000188460375082786833993","length":7863},"id":"CVE-2026-59645-dbafdc92","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989","target":{"file":"util/src/main/java/org/bouncycastle/oer/OERInputStream.java","function":"parse"}},{"target":{"function":"parseOpenType","file":"util/src/main/java/org/bouncycastle/oer/OERInputStream.java"},"deprecated":false,"digest":{"function_hash":"210001890843122775591667799759219882292","length":426},"id":"CVE-2026-59645-ddc8eea0","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["165766106122137720709208804080888710655","272363690230161298269371274755244300394","218816129600365152849701932294055365041","166202449970218380888907502459593937682"]},"id":"CVE-2026-59645-f0d1dc0f","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989","target":{"file":"util/src/test/java/org/bouncycastle/oer/test/AllTests.java"}}],"vanir_signatures_modified":"2026-10-16T09:59:43Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59645.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber"}]}