AISLE backfill adds a Bouncy Castle OpenPGP denial of service

CVE-2026-3505 is a pre-authentication resource-exhaustion flaw caused by an unbounded OpenPGP AEAD chunk-size value.

Bug class: Pre-authentication resource exhaustion
Affected codebase: Bouncy Castle Java OpenPGP
Credited system: AISLE
Disclosed: April 15, 2026
Attribution: Self-reported attribution
AI role: Discovery
Severity: high

Source status: The CNA record credits AISLE, describes the affected and fixed branches, and rates CVE-2026-3505 high at CVSS 4.0 8.7. AISLE's registry supplies the AI-workflow attribution.

Summary

A crafted OpenPGP AEAD message can declare an unbounded chunk size and drive resource exhaustion before authentication completes. The CNA record provides the accepted vulnerability, fix branches, reporter credit, and high 8.7 severity. The AI-system mapping remains self-reported through AISLE.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.