CVE-2026-13505

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme.

• CWE-772

• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505

Published

Aug 8, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13499A security flaw has been discovered in yashpokharna2555 rest…4.3
• CVE-2026-13500A weakness has been identified in antlr ANTLR4 up to 4.13.2.…7.3
• CVE-2026-13501A security vulnerability has been detected in antlr ANTLR4 u…5.3
• CVE-2026-13502A flaw has been found in antlr ANTLR4 up to 4.13.2. This aff…4.5
• CVE-2026-13503A vulnerability was detected in antlr ANTLR4 up to 4.13.2. A…5.5
• CVE-2026-13504A vulnerability has been found in code-projects Project Mana…3.5
• CVE-2026-13506In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence f…8.7
• CVE-2026-13507A vulnerability was detected in volcengine OpenViking up to …5
• CVE-2026-13508A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. T…5.5
• CVE-2026-13509A vulnerability has been found in RAGapp up to 0.1.5. Affect…6.3
• CVE-2026-13510A vulnerability was found in SimStudioAI sim up to 0.6.92. A…3.7
• CVE-2026-13511A vulnerability was determined in VoltAgent up to 2.1.17. Af…3.1