@@ -603,7 +603,7 @@
 <li>mauromol &lt;https://github.com/mauromol&gt; - reporting that RSASSA-PSS could not be used with a RIPEMD digest through the JCA API, tracing it to the missing PSS registrations and to DigestFactory.isSameDigest treating two identical non-SHA digest names as different (issue #2381) Reporting that EDIPartyName encoded its DirectoryString members without the RFC 5280 sec. 4.2.1.6 context tags its own decoder requires, so the type could not parse its own output (issue #2380).</li>
 <li>jmeeder &lt;https://github.com/jmeeder&gt; - reporting that RFC 4998 evidence-record generation rejected time stamps from an authority naming the digest with NULL parameters where BC names it with them absent, both of which RFC 5754 requires a receiver to accept (issue #2379).</li>
 <li>rimuln &lt;https://github.com/rimuln&gt; - diagnosis and fix for PKCS12 getCertificateAlias returning the alias of an unrelated certificate, tracing it to the alias and certificate enumerations of the keystore's certs table diverging in order once keys() enumerated a copy (issue #2384, PR #2385).</li>
-<li>Yu Bao &lt;yubao@paypal.com&gt; - reporting an API gap, on behalf of the PayPal Cyber Security Team, that the high-level OpenPGP message API (OpenPGPMessageProcessor / OpenPGPMessageInputStream) gave a caller no way to bound how far a compressed data packet expands, where the low-level PGPCompressedData it wraps has carried a bounded getDataStream(long) overload all along, and that OpenPGPPolicy exposed no equivalent property to set. Suggesting a protocol whitelist for CRL Distribution Point fetching, which is now the org.bouncycastle.x509.CRLDP_protocols property, and suggesting that an OCSP response was read up to the length the responder declared for itself, now capped by org.bouncycastle.ocsp.max_response_size.</li>
+<li>Yu Bao &lt;yubao@paypal.com&gt; - reporting an API gap, on behalf of the PayPal Cyber Security Team, that the high-level OpenPGP message API (OpenPGPMessageProcessor / OpenPGPMessageInputStream) gave a caller no way to bound how far a compressed data packet expands, where the low-level PGPCompressedData it wraps has carried a bounded getDataStream(long) overload all along, and that OpenPGPPolicy exposed no equivalent property to set. Suggesting a protocol whitelist for CRL Distribution Point fetching, which is now the org.bouncycastle.x509.CRLDP_protocols property, and suggesting that an OCSP response was read up to the length the responder declared for itself, now capped by org.bouncycastle.ocsp.max_response_size, and suggesting bounds on the OpenPGP ASCII armor headers, now capped by org.bouncycastle.openpgp.max_armor_header_length and org.bouncycastle.openpgp.max_armor_headers.</li>
 </ul>
 </body>
 </html>
@@ -80,6 +80,25 @@ public class Properties
      */
     public static final String OCSP_MAX_RESPONSE_SIZE = "org.bouncycastle.ocsp.max_response_size";
 
+    /**
+     * The longest OpenPGP ASCII armor header line, in bytes, ArmoredInputStream will accumulate.
+     * The headers are parsed when the stream is constructed, so this bounds what merely wrapping
+     * an untrusted stream can allocate: a "header line" that never reaches a line terminator is
+     * refused rather than read until the heap is gone. Default is 4096, far above the short
+     * Version / Comment lines RFC 9580 sec. 6.2 describes; a value of zero or less is ignored and
+     * the default used.
+     */
+    public static final String OPENPGP_MAX_ARMOR_HEADER_LENGTH = "org.bouncycastle.openpgp.max_armor_header_length";
+
+    /**
+     * The largest number of OpenPGP ASCII armor header lines ArmoredInputStream will accept before
+     * the blank line that ends the header block. Bounds the companion case to
+     * {@link #OPENPGP_MAX_ARMOR_HEADER_LENGTH}, where each line is short but they never stop
+     * arriving. Default is 64, counting the armor header line itself; a value of zero or less is
+     * ignored and the default used.
+     */
+    public static final String OPENPGP_MAX_ARMOR_HEADERS = "org.bouncycastle.openpgp.max_armor_headers";
+
     /**
      * If set to "true", the BC PKCS#12 KeyStore will additionally accept (on load only)
      * SafeBags of type secretBag that use SunJCE's non-standard nested encoding —
 
@@ -31,6 +31,9 @@ public class Properties
     public static final String X509_CRL_CACHE_TTL = "org.bouncycastle.x509.crl_cache_ttl";
     public static final String X509_ENABLE_CRLDP = "org.bouncycastle.x509.enableCRLDP";
     public static final String X509_CRLDP_PROTOCOLS = "org.bouncycastle.x509.CRLDP_protocols";
+    public static final String OCSP_MAX_RESPONSE_SIZE = "org.bouncycastle.ocsp.max_response_size";
+    public static final String OPENPGP_MAX_ARMOR_HEADER_LENGTH = "org.bouncycastle.openpgp.max_armor_header_length";
+    public static final String OPENPGP_MAX_ARMOR_HEADERS = "org.bouncycastle.openpgp.max_armor_headers";
     public static final String PKCS12_ALLOW_SUN_SECRET_KEYS = "org.bouncycastle.pkcs12.allow_sun_secret_keys";
     public static final String PKCS1_STRICT_DIGESTINFO = "org.bouncycastle.pkcs1.strict_digestinfo";
     public static final String JSSE_HOSTNAME_CHECK_CN_FALLBACK = "org.bouncycastle.jsse.hostname_check_cn_fallback";
 
@@ -113,6 +113,7 @@ <h3>2.1.2 Defects Fixed</h3>
 <li>The CRL fetcher behind X509RevocationChecker still downcast the opened connection to HttpURLConnection, so a CRL Distribution Point naming any protocol other than http or https threw a ClassCastException out of a method that declares IOException / CRLException. That downcast was removed from the provider's copy of CrlCache in the 1.68 cycle, because it stopped FTP based CRLs loading (github #1867), but the pkix copy was left as it was and has carried the defect since; its only caller catches Exception around the fetch, so the effect was not a visible failure but a distribution point quietly logged as ignored. The two fetchers are now identical. The same downcast has also been removed from the jdk1.4 overlay of the provider's CrlCache, which had likewise never had the #1867 fix applied - note that overlay still cannot set a connect or read timeout on the connection, as URLConnection.setConnectTimeout and setReadTimeout are Java 5.</li>
 <li>X509RevocationChecker downloaded CRLs from a certificate's CRL Distribution Points extension whenever the CRLs it had been given could not answer for a certificate, with no way for a caller to prevent it - unlike the provider's CertPath validator, which has always required the org.bouncycastle.x509.enableCRLDP property to be set, and unlike what that property's own javadoc describes ("the BC CertPath validator and X509RevocationChecker will attempt to download CRLs ..."). The checker now honours the property, so the URI taken from a certificate is only dereferenced when a caller has asked for that. <b>This is a behavioural change for anyone relying on the previous automatic fetch</b>: with the property unset the checker now behaves exactly as an unproductive fetch always did, soft failing where setSoftFail was configured and reporting no CRL found where it was not, so such callers should set org.bouncycastle.x509.enableCRLDP to "true" to keep the old behaviour.</li>
 <li>OcspCache.getOcspResponse read an OCSP response up to the length the responder itself declared in its Content-Length header, applying its own 32K ceiling only when that header was absent, so a responder (or anything able to answer in its place) that declared and sent hundreds of megabytes was read into the caller's heap. The declared length may now only narrow the read, never widen it: it is used when present and no larger than the ceiling, which is otherwise applied. The ceiling is now configurable through the new org.bouncycastle.ocsp.max_response_size property and its default has been raised from 32K to 64K, still far above any real response; a configured value of zero or less is ignored so a mistyped value cannot turn the limit off. An over-long response fails the OCSP check the same way an unreachable responder does - a caller with CRLs configured falls back to those - and now says so, as Streams.readAllLimited reports the condition only as "Data Overflow", which is restated in terms of the limit and the property that sets it.</li>
+<li>ArmoredInputStream parses the OpenPGP ASCII armor headers as the stream is constructed, and bounded neither the length of a header line nor the number of them, so merely wrapping an untrusted stream could exhaust the heap before the caller had read a byte. Two shapes reached it: a "header line" that never arrives at a line terminator, accumulated without limit, and short header lines that never stop arriving, added to the header list without limit - the second is the companion case, reachable even where every line is well formed. Both are now capped, at 4096 bytes per header line and 64 headers (counting the armor header line itself), each configurable through the new org.bouncycastle.openpgp.max_armor_header_length and org.bouncycastle.openpgp.max_armor_headers properties; a value of zero or less is ignored, so a mistyped value cannot turn a limit off. Exceeding either raises ArmoredInputException, as the other malformed-header cases in that parser do. RFC 9580 sec. 6.2 bounds neither, but the headers it describes - Version, Comment and the like - are short, so the defaults sit far above any real armor. The equivalent accumulation in org.bouncycastle.util.io.pem.PemReader is deliberately left unbounded: a PEM body can legitimately be enormous - a CRL in the gigabyte range - so a default cap there would break working deployments.</li>
 </ul>
 
 <h3>2.1.3 Additional Features and Functionality</h3>
 
@@ -9,6 +9,7 @@
 import java.util.List;
 
 import org.bouncycastle.util.StringList;
+import org.bouncycastle.util.Properties;
 import org.bouncycastle.util.Strings;
 
 /**
@@ -268,6 +269,20 @@ public int available()
         return in.available();
     }
 
+    private static final int DEFAULT_MAX_ARMOR_HEADER_LENGTH = 4096;
+    private static final int DEFAULT_MAX_ARMOR_HEADERS = 64;
+
+    /**
+     * A configured limit that cannot be one leaves the default in place, so a mistyped value
+     * cannot turn the limit off.
+     */
+    private static int armorLimit(String propertyName, int defaultValue)
+    {
+        int value = Properties.asInteger(propertyName, defaultValue);
+
+        return value > 0 ? value : defaultValue;
+    }
+
     private boolean parseHeaders()
         throws IOException
     {
@@ -305,6 +320,15 @@ private boolean parseHeaders()
             boolean eolReached = false;
             boolean crLf = false;
 
+            /*
+             * The headers are parsed as the stream is constructed, so these bound what wrapping an
+             * untrusted stream can allocate before the caller has read a byte: a "header line" that
+             * never reaches a terminator, and header lines that never stop arriving.
+             */
+            int maxHeaderLength = armorLimit(Properties.OPENPGP_MAX_ARMOR_HEADER_LENGTH,
+                DEFAULT_MAX_ARMOR_HEADER_LENGTH);
+            int maxHeaders = armorLimit(Properties.OPENPGP_MAX_ARMOR_HEADERS, DEFAULT_MAX_ARMOR_HEADERS);
+
             ByteArrayOutputStream buf = new ByteArrayOutputStream();
             buf.write('-');
 
@@ -347,12 +371,24 @@ private boolean parseHeaders()
                     {
                         throw new ArmoredInputException("invalid armor header");
                     }
+                    if (headerList.size() >= maxHeaders)
+                    {
+                        throw new ArmoredInputException("more than " + maxHeaders + " armor headers (see "
+                            + Properties.OPENPGP_MAX_ARMOR_HEADERS + ")");
+                    }
+
                     headerList.add(line);
                     buf.reset();
                 }
 
                 if (c != '\n' && c != '\r')
                 {
+                    if (buf.size() >= maxHeaderLength)
+                    {
+                        throw new ArmoredInputException("armor header line exceeds " + maxHeaderLength
+                            + " bytes (see " + Properties.OPENPGP_MAX_ARMOR_HEADER_LENGTH + ")");
+                    }
+
                     buf.write(c);
                     eolReached = false;
                 }
 
@@ -30,6 +30,7 @@ public void testPacketParsing()
             new TimeEncodingTest(),
             new ArmoredOutputStreamHeaderInjectionTest(),
             new ArmoredInputStreamCrcTest(),
+            new ArmoredInputStreamHeaderLimitTest(),
             new UserAttributeSubpacketInputStreamTest(),
             new UnknownPublicKeyPacketTest(),
             new UnknownSecretKeyPacketTest(),
 
@@ -0,0 +1,153 @@
+package org.bouncycastle.bcpg.test;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+
+import org.bouncycastle.bcpg.ArmoredInputStream;
+import org.bouncycastle.bcpg.ArmoredOutputStream;
+import org.bouncycastle.util.Arrays;
+import org.bouncycastle.util.Properties;
+import org.bouncycastle.util.Strings;
+import org.bouncycastle.util.io.Streams;
+
+/**
+ * ArmoredInputStream parses the armor headers as it is constructed, so what it accumulates there is
+ * reachable by merely wrapping an untrusted stream. Neither the length of a header line nor the
+ * number of them was bounded: a "header line" that never reaches a terminator, and short header
+ * lines that never stop arriving, each exhausted the heap inside the constructor. Both are now
+ * capped, by org.bouncycastle.openpgp.max_armor_header_length and
+ * org.bouncycastle.openpgp.max_armor_headers.
+ */
+public class ArmoredInputStreamHeaderLimitTest
+    extends AbstractPacketTest
+{
+    public String getName()
+    {
+        return "ArmoredInputStreamHeaderLimitTest";
+    }
+
+    public void performTest()
+        throws Exception
+    {
+        overLongHeaderLineIsRejected();
+        tooManyHeadersAreRejected();
+        configuredLimitsAreHonoured();
+        ordinaryArmorStillRoundTrips();
+    }
+
+    private void overLongHeaderLineIsRejected()
+        throws IOException
+    {
+        StringBuffer armor = new StringBuffer("-----BEGIN PGP MESSAGE-----\nComment: ");
+        for (int i = 0; i != 5000; i++)
+        {
+            armor.append('A');
+        }
+        armor.append("\n\n");
+
+        try
+        {
+            new ArmoredInputStream(new ByteArrayInputStream(Strings.toByteArray(armor.toString())));
+            fail("over-long armor header line accepted");
+        }
+        catch (IOException e)
+        {
+            isEquals("armor header line exceeds 4096 bytes (see org.bouncycastle.openpgp.max_armor_header_length)",
+                e.getMessage());
+        }
+    }
+
+    private void tooManyHeadersAreRejected()
+        throws IOException
+    {
+        StringBuffer armor = new StringBuffer("-----BEGIN PGP MESSAGE-----\n");
+        for (int i = 0; i != 100; i++)
+        {
+            armor.append("Comment: x\n");
+        }
+        armor.append("\n");
+
+        try
+        {
+            new ArmoredInputStream(new ByteArrayInputStream(Strings.toByteArray(armor.toString())));
+            fail("unbounded run of armor headers accepted");
+        }
+        catch (IOException e)
+        {
+            isEquals("more than 64 armor headers (see org.bouncycastle.openpgp.max_armor_headers)", e.getMessage());
+        }
+    }
+
+    /**
+     * The limits are configurable in both directions, and a value that cannot be a limit leaves the
+     * default in place rather than removing it.
+     */
+    private void configuredLimitsAreHonoured()
+        throws IOException
+    {
+        StringBuffer armor = new StringBuffer("-----BEGIN PGP MESSAGE-----\n");
+        for (int i = 0; i != 20; i++)
+        {
+            armor.append("Comment: x\n");
+        }
+        armor.append("\n");
+
+        byte[] armored = Strings.toByteArray(armor.toString());
+
+        // within the default limit of 64
+        new ArmoredInputStream(new ByteArrayInputStream(armored));
+
+        System.setProperty(Properties.OPENPGP_MAX_ARMOR_HEADERS, "8");
+        try
+        {
+            new ArmoredInputStream(new ByteArrayInputStream(armored));
+            fail("configured armor header limit ignored");
+        }
+        catch (IOException e)
+        {
+            isEquals("more than 8 armor headers (see org.bouncycastle.openpgp.max_armor_headers)", e.getMessage());
+        }
+        finally
+        {
+            System.getProperties().remove(Properties.OPENPGP_MAX_ARMOR_HEADERS);
+        }
+
+        System.setProperty(Properties.OPENPGP_MAX_ARMOR_HEADERS, "0");
+        try
+        {
+            // "0" cannot be a limit, so the default applies and this is accepted
+            new ArmoredInputStream(new ByteArrayInputStream(armored));
+        }
+        finally
+        {
+            System.getProperties().remove(Properties.OPENPGP_MAX_ARMOR_HEADERS);
+        }
+    }
+
+    private void ordinaryArmorStillRoundTrips()
+        throws IOException
+    {
+        byte[] data = Strings.toByteArray("Hello, World!");
+
+        ByteArrayOutputStream bOut = new ByteArrayOutputStream();
+        ArmoredOutputStream aOut = ArmoredOutputStream.builder()
+            .setVersion("BCPG")
+            .addComment("a comment")
+            .build(bOut);
+
+        aOut.write(data);
+        aOut.close();
+
+        ArmoredInputStream aIn = new ArmoredInputStream(new ByteArrayInputStream(bOut.toByteArray()));
+
+        isTrue("armored round trip", Arrays.areEqual(data, Streams.readAll(aIn)));
+
+        aIn.close();
+    }
+
+    public static void main(String[] args)
+    {
+        runTest(new ArmoredInputStreamHeaderLimitTest());
+    }
+}