Bug 2510250 (CVE-2026-58059)

Summary:	CVE-2026-58059 org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bniver, boliveir, bstansbe, cescoffi, dandread, dbruscin, dfreiber, dkreling, dlofthou, drichtar, drow, dschmidt, eglynn, ehelms, ehugonne, ewittman, flucifre, fmariani, fmongiar, gbenhaim, ggainey, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jjoyce, jlanda, jmartisk, jnethert, jpasqual, jpretori, jschluet, juwatts, jwon, kshier, kvanderr, lhh, lthon, manderse, mbenjamin, mburns, mcarlett, mdellweg, mgarciac, mhackett, mhulan, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sdawley, simaishi, smallamp, sostapov, ssilvert, stcannon, sthorger, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service (DoS) due to excessive resource consumption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2533189, 2533191
Bug Blocks:

Description OSIDB Bzimport 2026-08-03 03:02:55 UTC

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Comment 2 Jon Orris 2026-09-22 14:01:41 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP2

Via RHSA-2026:70257 https://access.redhat.com/errata/RHSA-2026:70257

Comment 3 Jon Orris 2026-09-24 19:57:00 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675