CVE-2026-13505

{
  "id": "CVE-2026-13505",
  "sourceIdentifier": "91579145-5d7b-4cc5-b925-a0262ff19630",
  "published": "2026-08-08T02:17:16.520",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme."
    },
    {
      "lang": "es",
      "value": "En Bouncy Castle para Java FIPS (BC-FJA) antes de bc-fips 1.0.2.7 (serie 1.0.X), 2.0.2 (serie 2.0.X) y 2.1.3 (serie 2.1.X), el material de clave sensible mantenido por los motores AES y DESede, los DRBG SP 800-90A, SymmetricSecretKey y las clases de parámetros PBKD y scrypt se puso a cero en la recolección de basura al anular Object.finalize. La finalización se ejecuta en un momento no especificado y en un orden no especificado y es atendida por un único hilo finalizador, por lo que cuando los objetos que llevan un finalizador se asignan más rápido de lo que ese hilo los retira, la cola de finalización pendiente crece sin límite: la eliminación se retrasa arbitrariamente, lo que puede contribuir a un OutOfMemoryError bajo carga, y el material de clave que esos objetos contienen permanece residente en el montón mientras estén en cola, anulando el propósito de la puesta a cero. El comportamiento no era un problema en Java 8 o Java 11; son las JVM posteriores, en las que la finalización ha sido deprecada y progresivamente despriorizada, donde se convierte en un problema. La eliminación de estas clases ahora se ejecuta desde un java.lang.ref.Cleaner registrado en la superposición multi-lanzamiento jdk1.9, por lo que en Java 9 y posteriores ya no depende de que el finalizador sea programado. Bouncy Castle para Java (bcprov) y Bouncy Castle para Java LTS no se ven afectados, ya que ninguno implementa el esquema de puesta a cero basado en finalizador."
    }
  ],
  "affected": [
    {
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
      "affectedData": [
        {
          "vendor": "Legion of the Bouncy Castle Inc.",
          "product": "BC-FJA",
          "defaultStatus": "unaffected",
          "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
          "packageName": "bc-fips",
          "platforms": [
            "all"
          ],
          "programFiles": [
            "SymmetricSecretKey",
            "SecretZeroizer",
            "AESWorkingBuffer",
            "DESedeWorkingBuffer",
            "HashDRBGWorkingBuffer",
            "HMacDRBGWorkingBuffer",
            "CTRDRBGWorkingBuffer"
          ],
          "packageURL": "pkg:maven/org.bouncycastle/bc-fips",
          "versions": [
            {
              "version": "1.0.0",
              "lessThan": "1.0.2.7",
              "versionType": "maven",
              "status": "affected"
            },
            {
              "version": "2.0.0",
              "lessThan": "2.0.2",
              "versionType": "maven",
              "status": "affected"
            },
            {
              "version": "2.1.0",
              "lessThan": "2.1.3",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T15:57:13.875169Z",
          "id": "CVE-2026-13505",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505",
      "source": "91579145-5d7b-4cc5-b925-a0262ff19630"
    }
  ]
}