p PatchFirst

CVE-2025-8916

CVE-2025-8916 · Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

CVSS 6.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • bc java

    Versions
    • ≥ 1.44, ≤ 1.78: Affected (maven)

    No fix published

  • bcpkix fips

    Versions
    • ≥ 1.0.0, ≤ 1.0.7: Affected (maven)
    • ≥ 2.0.0, ≤ 2.0.7: Affected (maven)

    No fix published

  • bouncycastle Debian:12

    Versions
    • 1.72-2
    • 1.77-1
    • 1.80-1
    • 1.80-2
    • 1.80-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bouncycastle Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.80-1

    Update to 1.80-1

  • bouncycastle Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.80-1

    Update to 1.80-1

  • bouncycastle Ubuntu:Pro:16.04:LTS

    Versions
    • 1.49+dfsg-3ubuntu1
    • 1.51-4ubuntu1
    • 1.51-4ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bouncycastle Ubuntu:Pro:18.04:LTS

    Versions
    • 1.57-1
    • 1.58-1
    • 1.59-1
    • 1.59-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bouncycastle Ubuntu:Pro:20.04:LTS

    Versions
    • 1.61-1
    • 1.61-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bouncycastle Ubuntu:22.04:LTS

    Versions
    • 1.68-2
    • 1.68-4
    • 1.68-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bouncycastle Ubuntu:Pro:24.04:LTS

    Versions
    • 1.72-2
    • 1.77-1
    Affected ranges
    • ECOSYSTEM: < 1.77-1ubuntu0.1~esm1

    Update to 1.77-1ubuntu0.1~esm1

Original sources

Check your server →