{"id":"CVE-2026-15055","title":"In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input","summary":"In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 …","severity":"high","cwe":["CWE-770"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15055","references":[{"url":"https://github.com/bcgit/bc-java/commit/7ab4ee67a0135950001b29b41a96d8a9a5d3b68b","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-15055","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15055.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15055"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510192"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15055"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15055"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.638Z","epss":0.0027,"epssPercentile":0.19471,"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","affected":["amq_clients","ceph_storage 9","enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-15055","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat AMQ Clients, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat Ceph Storage 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat AMQ Clients, Red Hat Enterprise Linux 8, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15055.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201464,"id":"CVE-2026-15055","ts":1789399476502,"field":"cvss","old":null,"new":"7.5"},{"seq":201463,"id":"CVE-2026-15055","ts":1789399476502,"field":"severity","old":"none","new":"high"},{"seq":200198,"id":"CVE-2026-15055","ts":1789396969123,"field":"cvss","old":"7.5","new":null},{"seq":200197,"id":"CVE-2026-15055","ts":1789396969123,"field":"severity","old":"high","new":"none"},{"seq":198121,"id":"CVE-2026-15055","ts":1789387993522,"field":"cvss","old":null,"new":"7.5"},{"seq":198120,"id":"CVE-2026-15055","ts":1789387993522,"field":"severity","old":"none","new":"high"},{"seq":195915,"id":"CVE-2026-15055","ts":1789383339381,"field":"cvss","old":"7.5","new":null},{"seq":195914,"id":"CVE-2026-15055","ts":1789383339381,"field":"severity","old":"high","new":"none"},{"seq":194844,"id":"CVE-2026-15055","ts":1789380277169,"field":"cvss","old":null,"new":"7.5"},{"seq":194843,"id":"CVE-2026-15055","ts":1789380277169,"field":"severity","old":"none","new":"high"},{"seq":193631,"id":"CVE-2026-15055","ts":1789378201059,"field":"cvss","old":"7.5","new":null},{"seq":193630,"id":"CVE-2026-15055","ts":1789378201059,"field":"severity","old":"high","new":"none"},{"seq":192418,"id":"CVE-2026-15055","ts":1789376197756,"field":"cvss","old":null,"new":"7.5"},{"seq":192417,"id":"CVE-2026-15055","ts":1789376197756,"field":"severity","old":"none","new":"high"},{"seq":191205,"id":"CVE-2026-15055","ts":1789373067552,"field":"cvss","old":"7.5","new":null},{"seq":191204,"id":"CVE-2026-15055","ts":1789373067552,"field":"severity","old":"high","new":"none"},{"seq":189990,"id":"CVE-2026-15055","ts":1789369099807,"field":"cvss","old":null,"new":"7.5"},{"seq":189989,"id":"CVE-2026-15055","ts":1789369099807,"field":"severity","old":"none","new":"high"},{"seq":188777,"id":"CVE-2026-15055","ts":1789367999182,"field":"cvss","old":"7.5","new":null},{"seq":188776,"id":"CVE-2026-15055","ts":1789367999182,"field":"severity","old":"high","new":"none"},{"seq":187560,"id":"CVE-2026-15055","ts":1789364961725,"field":"cvss","old":null,"new":"7.5"},{"seq":187559,"id":"CVE-2026-15055","ts":1789364961725,"field":"severity","old":"none","new":"high"},{"seq":186347,"id":"CVE-2026-15055","ts":1789362940741,"field":"cvss","old":"7.5","new":null},{"seq":186346,"id":"CVE-2026-15055","ts":1789362940741,"field":"severity","old":"high","new":"none"},{"seq":185133,"id":"CVE-2026-15055","ts":1789360942258,"field":"cvss","old":null,"new":"7.5"},{"seq":185132,"id":"CVE-2026-15055","ts":1789360942258,"field":"severity","old":"none","new":"high"},{"seq":183920,"id":"CVE-2026-15055","ts":1789357863902,"field":"cvss","old":"7.5","new":null},{"seq":183919,"id":"CVE-2026-15055","ts":1789357863902,"field":"severity","old":"high","new":"none"},{"seq":182172,"id":"CVE-2026-15055","ts":1789354067439,"field":"cvss","old":null,"new":"7.5"},{"seq":182171,"id":"CVE-2026-15055","ts":1789354067439,"field":"severity","old":"none","new":"high"},{"seq":180965,"id":"CVE-2026-15055","ts":1789352894517,"field":"cvss","old":"7.5","new":null},{"seq":180964,"id":"CVE-2026-15055","ts":1789352894517,"field":"severity","old":"high","new":"none"},{"seq":179758,"id":"CVE-2026-15055","ts":1789349962534,"field":"cvss","old":null,"new":"7.5"},{"seq":179757,"id":"CVE-2026-15055","ts":1789349962534,"field":"severity","old":"none","new":"high"},{"seq":178551,"id":"CVE-2026-15055","ts":1789347752585,"field":"cvss","old":"7.5","new":null},{"seq":178550,"id":"CVE-2026-15055","ts":1789347752585,"field":"severity","old":"high","new":"none"},{"seq":177344,"id":"CVE-2026-15055","ts":1789346149226,"field":"cvss","old":null,"new":"7.5"},{"seq":177343,"id":"CVE-2026-15055","ts":1789346149226,"field":"severity","old":"none","new":"high"},{"seq":176137,"id":"CVE-2026-15055","ts":1789342687421,"field":"cvss","old":"7.5","new":null},{"seq":176136,"id":"CVE-2026-15055","ts":1789342687421,"field":"severity","old":"high","new":"none"},{"seq":175923,"id":"CVE-2026-15055","ts":1789342293933,"field":"cvss","old":null,"new":"7.5"},{"seq":175922,"id":"CVE-2026-15055","ts":1789342293933,"field":"severity","old":"none","new":"high"},{"seq":175461,"id":"CVE-2026-15055","ts":1789338321356,"field":"cvss","old":"7.5","new":null},{"seq":175460,"id":"CVE-2026-15055","ts":1789338321356,"field":"severity","old":"high","new":"none"},{"seq":174256,"id":"CVE-2026-15055","ts":1789334567444,"field":"cvss","old":null,"new":"7.5"},{"seq":174255,"id":"CVE-2026-15055","ts":1789334567444,"field":"severity","old":"none","new":"high"},{"seq":173051,"id":"CVE-2026-15055","ts":1789333147655,"field":"cvss","old":"7.5","new":null},{"seq":173050,"id":"CVE-2026-15055","ts":1789333147655,"field":"severity","old":"high","new":"none"},{"seq":171865,"id":"CVE-2026-15055","ts":1789330855103,"field":"cvss","old":null,"new":"7.5"},{"seq":171864,"id":"CVE-2026-15055","ts":1789330855103,"field":"severity","old":"none","new":"high"}]}