CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-103603

Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 44.4%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-103603

Bouncycastle » Bc-Csharp » Version: N/A

cpe:2.3:a:bouncycastle:bc-csharp:-
Bouncycastle » Bc-Csharp » Version: 1.7.0

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0
Bouncycastle » Bc-Csharp » Version: 1.7.0.1

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0.1
Bouncycastle » Bc-Csharp » Version: 1.7.0.2

cpe:2.3:a:bouncycastle:bc-csharp:1.7.0.2
Bouncycastle » Bc-Csharp » Version: 1.8.0

cpe:2.3:a:bouncycastle:bc-csharp:1.8.0
Bouncycastle » Bc-Csharp » Version: 1.8.1

cpe:2.3:a:bouncycastle:bc-csharp:1.8.1
Bouncycastle » Bc-Csharp » Version: 1.8.10

cpe:2.3:a:bouncycastle:bc-csharp:1.8.10
Bouncycastle » Bc-Csharp » Version: 1.8.2

cpe:2.3:a:bouncycastle:bc-csharp:1.8.2
Bouncycastle » Bc-Csharp » Version: 1.8.3

cpe:2.3:a:bouncycastle:bc-csharp:1.8.3
Bouncycastle » Bc-Csharp » Version: 1.8.4

cpe:2.3:a:bouncycastle:bc-csharp:1.8.4
Bouncycastle » Bc-Csharp » Version: 1.8.5

cpe:2.3:a:bouncycastle:bc-csharp:1.8.5
Bouncycastle » Bc-Csharp » Version: 1.8.6

cpe:2.3:a:bouncycastle:bc-csharp:1.8.6
Bouncycastle » Bc-Csharp » Version: 1.8.7

cpe:2.3:a:bouncycastle:bc-csharp:1.8.7
Bouncycastle » Bc-Csharp » Version: 1.8.8

cpe:2.3:a:bouncycastle:bc-csharp:1.8.8
Bouncycastle » Bc-Csharp » Version: 1.8.9

cpe:2.3:a:bouncycastle:bc-csharp:1.8.9
Bouncycastle » Bc-Csharp » Version: 1.9.0

cpe:2.3:a:bouncycastle:bc-csharp:1.9.0
Bouncycastle » Bc-Csharp » Version: 2.0.0

cpe:2.3:a:bouncycastle:bc-csharp:2.0.0
Bouncycastle » Bc-Csharp » Version: 2.1.0

cpe:2.3:a:bouncycastle:bc-csharp:2.1.0
Bouncycastle » Bc-Csharp » Version: 2.1.1

cpe:2.3:a:bouncycastle:bc-csharp:2.1.1
Bouncycastle » Bc-Csharp » Version: 2.2.0

cpe:2.3:a:bouncycastle:bc-csharp:2.2.0
Bouncycastle » Bc-Csharp » Version: 2.2.1

cpe:2.3:a:bouncycastle:bc-csharp:2.2.1
Bouncycastle » Bc-Csharp » Version: 2.3.0

cpe:2.3:a:bouncycastle:bc-csharp:2.3.0
Bouncycastle » Bc-Csharp » Version: 2.3.1

cpe:2.3:a:bouncycastle:bc-csharp:2.3.1
Bouncycastle » Bc-Csharp » Version: 2.4.0

cpe:2.3:a:bouncycastle:bc-csharp:2.4.0
Bouncycastle » Bc-Csharp » Version: 2.5.0

cpe:2.3:a:bouncycastle:bc-csharp:2.5.0
Bouncycastle » Bc-Csharp » Version: 2.5.1

cpe:2.3:a:bouncycastle:bc-csharp:2.5.1
Bouncycastle » Bc-Csharp » Version: 2.6.0

cpe:2.3:a:bouncycastle:bc-csharp:2.6.0
Bouncycastle » Bc-Csharp » Version: 2.6.1

cpe:2.3:a:bouncycastle:bc-csharp:2.6.1
Bouncycastle » Bc-Csharp » Version: 2.6.2

cpe:2.3:a:bouncycastle:bc-csharp:2.6.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-103603

Products

Pricing

Contact Us