Bouncy Castle bc-csharp: Denial of service in OpenPGP subpacket parsing
Summary
bc-csharp, the .NET library for OpenPGP operations from Legion of the Bouncy Castle, allocates a buffer based on an unchecked length field in OpenPGP signature and user attribute subpackets. A remote, unauthenticated attacker who can supply a crafted OpenPGP public key, certificate or signature can trigger an OutOfMemoryException or memory exhaustion with only a few bytes of input. The impact is a denial of service in applications that parse untrusted OpenPGP data.
Affected
- bc-csharp before 2.7.0 (NuGet package BouncyCastle.Cryptography)
- Vendor wiki lists 2.6.2 and earlier, and 2.7.0-beta.98, as affected
Fixed in
- Upgrade to bc-csharp 2.7.0 or later
Workaround
- No vendor workaround. Upgrading is recommended.
- Until upgraded, do not parse OpenPGP keys or signatures from untrusted sources.
- Treat OutOfMemoryException during OpenPGP parsing as a parse failure and limit concurrent parsing.
Exploitation
- No known exploitation in the wild. Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
Our recommendation
- Check .NET applications and vendor software for bc-csharp or BouncyCastle.Cryptography below 2.7.0, including transitive dependencies.
- Upgrade to 2.7.0 or later, starting with internet-facing services that process OpenPGP input.
- Until patched, isolate OpenPGP parsing in a separate process with memory limits.
- Monitor services that handle OpenPGP data for out-of-memory errors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bouncy Castle advisory for CVE-2026-63574 github.com
- Fix commit: adds the 2 MiB limit github.com
- Fix commit: adds remaining-data check and MalformedPacketException github.com
- OSV entry for CVE-2026-63574 osv.dev
- VulDB entry for CVE-2026-63574 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:10.
Original description (NVD)
Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote, unauthenticated attacker who can supply a crafted OpenPGP public key, certificate or signature to cause a denial of service (OutOfMemoryException or memory exhaustion in the parsing process) via a subpacket header using the five-octet length form, because the declared length was used to size the subpacket buffer with no upper bound and without being compared with the size of the enclosing subpacket area or packet, so a few bytes of input could demand an allocation of up to about 2 GB before any subpacket data was read.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.