Bouncy Castle bc-csharp: Denial of service via unbounded CMP/CRMF PBM iteration count

Summary

The Bouncy Castle C# library (bc-csharp) before 2.7.0 does not limit the password-based MAC iteration count in CMP and CRMF message verification unless the caller set an explicit maximum via a specific constructor. A remote, unauthenticated attacker can send a single crafted CMP message or certificate request that forces up to about 2^31 hash iterations, keeping a CPU core busy for minutes. Repeated messages can exhaust a CMP server such as a certificate authority or registration authority.

Affected

• bc-csharp (NuGet BouncyCastle.Cryptography) versions 0 to before 2.7.0
• Exposed only where applications verify CMP messages or CRMF certificate requests from untrusted parties, for example ProtectedPkiMessage.Verify or CertificateRequestMessage.IsValidSigningKeyPop with the default constructor

Fixed in

• BC C# .NET 2.7.0 (default iteration limit of 1,000,000 applied)

Workaround

• Upgrade to 2.7.0 or later. This is the vendor remedy.
• If an upgrade is not possible immediately, construct the verifying PKMacBuilder as new PKMacBuilder(new DefaultPKMacPrimitivesProvider(), maxIterations) with a positive maxIterations that covers legitimate peers, or read the iteration count from the message and reject excessive values before calling Verify or IsValidSigningKeyPop.
• Restrict and rate-limit network access to CMP and certificate-request endpoints.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No evidence of in-the-wild exploitation found.
• No public proof of concept found.

Our recommendation

• Check whether any .NET application or PKI component uses bc-csharp for CMP or CRMF processing, including transitive NuGet dependencies.
• Update BouncyCastle.Cryptography to 2.7.0 or later and verify the version against the NuGet package.
• If upgrading is delayed, apply the explicit-maximum constructor or message pre-checks described in the vendor advisory.
• Limit exposure of CA, RA or enrolment endpoints to trusted networks and monitor for CPU spikes and repeated CMP requests.
• Applications that only create PBM-protected messages or accept messages solely from trusted sources are not affected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Vendor advisory (bc-csharp wiki) github.com
• Fix commit: adds the default limit github.com
• Fix commit: sets the default to 1,000,000 github.com
• Fix commit: rejects counts outside valid range github.com
• OSV entry CVE-2026-63568 osv.dev
• VulnERS CVE-2026-63568 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:14.