Repository navigation
Possible memory leak in bc-fips related to Java finalizers #1776
Description
A memory analysis of a jmap memory dump revealed a significant number of java.lang.ref.Finalizer references. The referent is org.bouncycastle.crypto.fips.FipsPBKD$Parameters, created with call stack:
org.bouncycastle.jcajce.provider.ProvBCFKS$BCFIPSKeyStoreSpi.generateKey(Unknown Source)
at org.bouncycastle.jcajce.provider.ProvBCFKS$BCFIPSKeyStoreSpi.decryptData(Unknown Source)
at org.bouncycastle.jcajce.provider.ProvBCFKS$BCFIPSKeyStoreSpi.engineLoad(Unknown Source)
at java.security.KeyStore.load(java.base@11.0.23/KeyStore.java:1479)
We believe this is related to the use of finalizers (finalize methods) in bc-fips code. Finalizers are problematic, in part due to their two-pass nature.
Two possible solutions, in increasing order of difficulty:
- Simply remove all finalize methods.
- Replace the finalize methods with an alternative strategy, such as try-with-resources.
Regarding solution 1), since the finalize methods are primarily overwriting arrays with zeros, the security risk of removing them should be minimal, as most modern operating systems already ensure that freed memory isn't visible to other processes.
Additionally, issue #1536 refers to java.lang.ref.Finalizer, but it’s unclear if it's the same problem since that issue does not include the path.
The versions of the Bouncy Castle JARs used:
| JAR | Version |
|---|---|
| bc-fips | 1.0.2.4 |
| bctls-fips | 1.0.18 |
The JRE is OpenJDK 11 on Red Hat Enterprise Linux 8.10.
Activity
dghgit commentedon May 26, 2026
Closing as inactive. For the record though, we've been progressively removing finalizers in the API due to the GC changes in Java 13. BC-FJA 3.0.0 will not have any finalizers in it at all. There haven't been any reports we have received where finalizers have actually caused a memory leak, but it's clear that in the post Java 13 world, things with finalize seem to have been becoming odder and odder.