Bouncy Castle for Java FIPS and LTS Excessive Resource Allocation Vulnerability

A vulnerability allowing uncontrolled resource consumption has been identified in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS (versions 2.1.0 through 2.1.1) and Bouncy Castle for Java LTS (versions 2.73.0 through 2.73.7). This vulnerability, associated with several native AES and SHA-2 digest implementations, can lead to excessive memory allocation. The issue is particularly pronounced in high-core environments running Java 21 with Bouncy Castle FIPS 2.1.1, where the disposal thread responsible for cleaning up resources is not scheduled frequently enough under heavy load.

Impact

Excessive resource allocation can lead to performance degradation and potential denial-of-service conditions, especially in high-core environments.

Remediation

Users can upgrade to Bouncy Castle for Java FIPS 2.1.2 or Bouncy Castle for Java LTS 2.73.8 to address this vulnerability. For those still using Java 8, a new property 'org.bouncycastle.native.cleanup_priority' can be set to 'min', 'normal', or 'high' to optimize the disposal thread scheduling.