> CVE-2025-8916

« BACK_TO_HOME
PUBLISHED
2025-08-13 10:15
MODIFIED
2025-09-12 12:15
EPSS (Prob. Exploit)
0.50%
Top 57.1%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-10-11

> DESCRIPTION

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> GITHUB SECURITY ADVISORY

GHSA-4cx2-fc23-5wg6 MODERATE

Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

AFFECTED PACKAGES:
MAVEN / org.bouncycastle:bcpkix-jdk18on
>= 1.44, < 1.79
Fixed in: 1.79
MAVEN / org.bouncycastle:bcpkix-jdk15to18
>= 1.44, < 1.79
Fixed in: 1.79
MAVEN / org.bouncycastle:bcpkix-jdk15on
>= 1.44, < 1.79
Fixed in: 1.79
MAVEN / org.bouncycastle:bcpkix-fips
>= 2.0.0, <= 2.0.7
Fixed in: 2.0.8
MAVEN / org.bouncycastle:bcpkix-fips
>= 1.0.0, <= 1.0.7
Fixed in: 1.0.8

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

AFFECTED PACKAGES:
Unknown / Unknown
6 versions affected
ALIASES:
GHSA-4cx2-fc23-5wg6

> HISTORIQUE DES MODIFICATIONS

Première apparition
13/08/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:07
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:09
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:09
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME