Memory Management Issue in Bouncy Castle for Java FIPS Affecting Key Zeroisation
CVE-2026-13505

8.7HIGH

Key Information:

Vendor

Legion Of The Bouncy Castle Inc.

Status
Bc-fja
Vendor
CVE Published:
8 August 2026

What is CVE-2026-13505?

The Bouncy Castle for Java FIPS has a significant vulnerability relating to the improper zeroisation of sensitive key material held by its various engine types. This occurs due to the reliance on the finalizer mechanism, which can lead to delayed release of memory containing cryptographic keys. As a result, when objects that hold sensitive key data are queued for finalization, they remain accessible in memory longer than intended, exposing them to potential attacks. This issue primarily affects environments running Java versions post-8, where the finalization process has been deprioritized, highlighting the importance of migrating to improved memory disposal methods that do not rely on finalizers.

Affected Version(s)

BC-FJA all 1.0.0 < 1.0.2.7

BC-FJA all 2.0.0 < 2.0.2

BC-FJA all 2.1.0 < 2.1.3

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.