CVE-2026-59646
Description
In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
Summary dbcve.org
The DTLS handshake reassembler in Bouncy Castle for Java fails to validate a 24-bit length field before allocating buffers, potentially allowing an attacker to trigger excessive memory allocation or buffer overflow conditions via specially crafted DTLS handshake messages.
Mitigation
Upgrade Bouncy Castle for Java to version 1.85 or later (LTS to 2.73.12 or later), or BC-FIPS to bctls-fips 1.0.24/2.0.24/2.1.24 or later. If immediate upgrade is not possible, consider restricting DTLS connectivity or implementing network-level filtering.