Log in Start free

Vulnerability · Published Aug 12, 2025 · Assigned by bcorg

CVE-2025-8885Possible DOS in processing specially formed ASN.1 Object Identifiers

Medium 6.3

In plain English

A medium-severity resource allocation without limits in BC-FJA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bouncycastleno fix listedDEBIAN-CVE-2025-8885
Debian:13bouncycastle1.80-1DEBIAN-CVE-2025-8885
Debian:14bouncycastle1.80-1DEBIAN-CVE-2025-8885
Mavenorg.bouncycastle:bc-fips1.0.2.6GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bc-fips2.0.1GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bcprov-jdk141.78GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bcprov-jdk15to181.78GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bcprov-jdk18on1.78GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bctls-jdk141.78GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bctls-jdk15to181.78GHSA-67mf-3cr5-8w23
Mavenorg.bouncycastle:bctls-jdk18on1.78GHSA-67mf-3cr5-8w23
Ubuntu:22.04:LTSbouncycastleno fix listedUBUNTU-CVE-2025-8885
Ubuntu:24.04:LTSbouncycastleno fix listedUBUNTU-CVE-2025-8885

Affected products (as reported)

VendorProductVersions
Legion of the Bouncy Castle Inc. BC Java 1.0 – through 1.77
Legion of the Bouncy Castle Inc. BC-FJA 1.0.0 – through 1.0.2.52.0.0 – through 2.0.1

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

References