Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

2024-05-1415:32:54

Google

osv.dev

bouncy castle

java cryptography

apis

ed25519

verification code

infinite loop

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

CPENameOperatorVersion
org.bouncycastle:bcpkix-jdk14eq1.75
org.bouncycastle:bcpkix-jdk14eq1.56
org.bouncycastle:bcpkix-jdk18oneq1.72
org.bouncycastle:bcpkix-jdk15to18eq1.73
org.bouncycastle:bcpkix-jdk18oneq1.75
org.bouncycastle:bcpkix-jdk15to18eq1.76
org.bouncycastle:bcprov-jdk18oneq1.71
org.bouncycastle:bcprov-jdk15to18eq1.74
org.bouncycastle:bcprov-jdk15oneq1.48
org.bouncycastle:bcpkix-jdk14eq1.71

Name	Operator	Version
org.bouncycastle:bcpkix-jdk14	eq	1.75
org.bouncycastle:bcpkix-jdk14	eq	1.56
org.bouncycastle:bcpkix-jdk18on	eq	1.72
org.bouncycastle:bcpkix-jdk15to18	eq	1.73
org.bouncycastle:bcpkix-jdk18on	eq	1.75
org.bouncycastle:bcpkix-jdk15to18	eq	1.76
org.bouncycastle:bcprov-jdk18on	eq	1.71
org.bouncycastle:bcprov-jdk15to18	eq	1.74
org.bouncycastle:bcprov-jdk15on	eq	1.48
org.bouncycastle:bcpkix-jdk14	eq	1.71