← Back to the live CVE advisory feed

CVE-2026-103603: Product identification pending

Severity

8.7 (HIGH)

Affected versions

Before 2.7.0

Fixed version

2.7.0

Patch status

Patched

Published

2026-10-02T08:17:00.837

Modified

2026-10-02T08:17:00.837

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L – 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.

View the official NVD record for CVE-2026-103603

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.