CVE-2025-8885
CVE-2025-8885 · Possible DOS in processing specially formed ASN.1 Object Identifiers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
CVSS 6.3 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
bc java
- Versions
- ≥ 1.0, ≤ 1.77: Affected (maven)
No fix published
bc-fja
- Versions
- ≥ 1.0.0, ≤ 1.0.2.5: Affected (maven)
- ≥ 2.0.0, ≤ 2.0.1: Affected (maven)
No fix published
bouncycastle Debian:12
- Versions
- 1.72-2
- 1.77-1
- 1.80-1
- 1.80-2
- 1.80-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Debian:13
- Affected ranges
- ECOSYSTEM: < 1.80-1
Update to 1.80-1
bouncycastle Debian:14
- Affected ranges
- ECOSYSTEM: < 1.80-1
Update to 1.80-1
bouncycastle Ubuntu:Pro:16.04:LTS
- Versions
- 1.49+dfsg-3ubuntu1
- 1.51-4ubuntu1
- 1.51-4ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:18.04:LTS
- Versions
- 1.57-1
- 1.58-1
- 1.59-1
- 1.59-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:20.04:LTS
- Versions
- 1.61-1
- 1.61-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:22.04:LTS
- Versions
- 1.68-2
- 1.68-4
- 1.68-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:24.04:LTS
- Versions
- 1.72-2
- 1.77-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published