CVE-2025-8885
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-09-12
Assigner: bcorg
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| legion_of_the_bouncy_castle_inc | bc_fja | 1.0.0 |
| legion_of_the_bouncy_castle_inc | bc_java | 1.77 |
| legion_of_the_bouncy_castle_inc | bc_fja | 2.0.0 |
| legion_of_the_bouncy_castle_inc | bc_java | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8885 is a vulnerability in Bouncy Castle for Java where ASN.1 Object Identifiers (OIDs) can be created without limits on their size. This means an attacker can supply excessively large ASN.1 encodings that the system will process, potentially causing a Denial of Service (DoS) by consuming excessive resources. The vulnerability arises because there were no size restrictions on the encoded identifiers or their string lengths until version 1.78, which introduced limits to mitigate this issue. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to perform a Denial of Service (DoS) attack against applications using affected versions of Bouncy Castle for Java. By sending excessively large ASN.1 encoded data, the attacker can cause the application to allocate excessive resources, potentially leading to crashes, degraded performance, or unavailability of the service. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for processing of excessively large ASN.1 Object Identifier (OID) encodings or unusually large ASN.1 strings that exceed normal size limits. Since the vulnerability arises from uncapped ASN.1 OID sizes, you can detect attempts by inspecting ASN.1 data inputs for sizes exceeding 4096 bytes or identifier strings longer than 16,385 characters. Commands or tools that parse ASN.1 data (e.g., using OpenSSL's asn1parse) can be used to analyze ASN.1 structures for abnormal sizes. For example, using 'openssl asn1parse -in <file>' to inspect ASN.1 data and scripting checks for large OID lengths may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Bouncy Castle for Java to version 1.78 or later, which introduces limits on ASN.1 Object Identifier sizes (maximum 4096 bytes for encoded identifiers and 16,385 characters for identifier strings). Additionally, enforce validation and size caps on ASN.1 encodings before processing them, especially if the data comes from untrusted or external sources. Implement input validation to reject ASN.1 objects exceeding these limits to prevent Denial of Service attacks. [1]