CVE-2026-103603
HIGH
MEDIUM
Priority: 0.05
BB Relevance:
78/100
Published: 2026-10-02
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
None
VI:
None
VA:
High
Description
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| bouncycastle | bc-csharp | < 2.7.0 |
References & Advisories (2)
Patch
Vendor Advisory
Patch