CVE-2025-8916
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-13

Last updated on: 2025-09-12

Assigner: bcorg

Description
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-13
Last Modified
2025-09-12
Generated
2026-05-07
AI Q&A
2025-08-13
EPSS Evaluated
2026-05-05
NVD
CVE-2025-8916
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
legion_of_the_bouncy_castle_inc bcpkix_fips 2.0.7
legion_of_the_bouncy_castle_inc bc_java 1.44
legion_of_the_bouncy_castle_inc bcpkix_fips 2.0.0
legion_of_the_bouncy_castle_inc bcpkix_fips 1.0.0
legion_of_the_bouncy_castle_inc bc_java 1.78
legion_of_the_bouncy_castle_inc bcpkix_fips 1.0.7
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an Allocation of Resources Without Limits or Throttling issue in the Legion of the Bouncy Castle Inc. Bouncy Castle for Java libraries (bcpkix, bcprov, bcpkix-fips). It allows excessive allocation of resources, which means the affected software does not properly limit or throttle resource usage, potentially leading to resource exhaustion.


How can this vulnerability impact me? :

The vulnerability can lead to excessive allocation of resources, which may cause performance degradation, denial of service, or system instability due to resource exhaustion when the affected Bouncy Castle Java libraries are used.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart