CVE-2026-3505: Legion Of The Bouncy Castle Inc Bc-Java

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java. This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Affected products

Legion Of The Bouncy Castle Inc Bc-Java: from 1.74, before 1.80.2 (fixed in 1.80.2); from 1.81, before 1.81.1 (fixed in 1.81.1); from 1.82, before 1.84 (fixed in 1.84)
Red Hat Openshift Developer Tools And Services
Red Hat Openshift Developer Tools And Services 4.12: before 1786628667 (fixed in 1786628667)
Red Hat Openshift Developer Tools And Services 4.13: before 1786628681 (fixed in 1786628681)
Red Hat Openshift Developer Tools And Services 4.14: before 1786533561 (fixed in 1786533561)
Red Hat Openshift Developer Tools And Services 4.15: before 1786533565 (fixed in 1786533565)
Red Hat Openshift Developer Tools And Services 4.16: before 1787125166 (fixed in 1787125166)
Red Hat Openshift Developer Tools And Services 4.17: before 1787124635 (fixed in 1787124635)
Red Hat Openshift Developer Tools And Services 4.18: before 1787125069 (fixed in 1787125069)
Red Hat Openshift Developer Tools And Services 4.19: before 1787124632 (fixed in 1787124632)
Red Hat Openshift Developer Tools And Services 4.20: before 1787124925 (fixed in 1787124925)
Red Hat Openshift Developer Tools And Services 4.21: before 1787125311 (fixed in 1787125311)
Red Hat Openshift Developer Tools And Services 4.22: before 1787124779 (fixed in 1787124779)
Red Hat Red Hat Amq Clients
Red Hat Red Hat Build Of Apache Camel 4.14 For Quarkus 3.27
Red Hat Red Hat Build Of Apache Camel 4.18.1 For Spring Boot 3.5.14
Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Red Hat Data Grid 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Fuse 7
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 7: before 0:2.16.0-22.redhat_00057.1.el7eap (fixed in 0:2.16.0-22.redhat_00057.1.el7eap); before 0:2.3.14-11.SP11_redhat_00001.1.el7eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el7eap); before 0:1.5.26-2.Final_redhat_00001.1.el7eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el7eap); before 0:2.18.8-1.redhat_00003.1.el7eap (fixed in 0:2.18.8-1.redhat_00003.1.el7eap); before 0:5.0.31-3.SP2_redhat_00001.1.el7eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el7eap); before 0:1.10.0-46.Final_redhat_00044.1.el7eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap); …
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 8: before 0:2.16.0-22.redhat_00057.1.el8eap (fixed in 0:2.16.0-22.redhat_00057.1.el8eap); before 0:2.3.14-11.SP11_redhat_00001.1.el8eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el8eap); before 0:1.5.26-2.Final_redhat_00001.1.el8eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el8eap); before 0:2.18.8-1.redhat_00003.1.el8eap (fixed in 0:2.18.8-1.redhat_00003.1.el8eap); before 0:5.0.31-3.SP2_redhat_00001.1.el8eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el8eap); before 0:1.10.0-46.Final_redhat_00044.1.el8eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el8eap); …
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 9: before 0:2.16.0-22.redhat_00057.1.el9eap (fixed in 0:2.16.0-22.redhat_00057.1.el9eap); before 0:2.3.14-11.SP11_redhat_00001.1.el9eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el9eap); before 0:1.5.26-2.Final_redhat_00001.1.el9eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el9eap); before 0:2.18.8-1.redhat_00003.1.el9eap (fixed in 0:2.18.8-1.redhat_00003.1.el9eap); before 0:5.0.31-3.SP2_redhat_00001.1.el9eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el9eap); before 0:1.10.0-46.Final_redhat_00044.1.el9eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el9eap); …
Red Hat Red Hat JBoss Enterprise Application Platform 8
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.ga: before 1.84.0.redhat-00001 (fixed in 1.84.0.redhat-00001)
and 8 more

Published 2026-04-15. Last modified 2026-09-18.