CVE-2023-33202
Bouncy Castle Denial of Service (DoS)
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
CVE-2023-33202- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
CVE-2023-33202- Updated
- 2026-11-02
EUVDEUVD-2023-3052 No score
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
EUVD-2023-3052- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wjxj-5m7g-mg7q
Bouncy Castle Denial of Service (DoS)
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.
- Record
GHSA-wjxj-5m7g-mg7q- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-33202
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
DEBIAN-CVE-2023-33202- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-wjxj-5m7g-mg7q
Bouncy Castle Denial of Service (DoS)
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.
- Record
GHSA-wjxj-5m7g-mg7q- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-33202
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
UBUNTU-CVE-2023-33202- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1781571259 No score
TuxCare security update for org.bouncycastle (3 CVEs)
TuxCare rebuilt 4 org.bouncycastle packages to address 3 CVEs. Fixed in 1.64-tuxcare.5.
- Record
CLSA-2026-1781571259- Updated
- 2026-11-02
OSV No score
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)
- Record
CVE-2023-33202- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-33202 No score
CVE-2023-33202 in org.bouncycastle:bcprov-jdk15on - Patched by Root
Root has patched CVE-2023-33202 in the org.bouncycastle:bcprov-jdk15on package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-33202- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.bouncycastle:bcprov-jdk18onMaven |
before 1.73 | 1.73 |
org.bouncycastle:bcpkix-jdk18onMaven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-ext-jdk15onMaven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-ext-jdk16Maven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-jdk14Maven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-jdk15Maven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-jdk15to18Maven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-jdk16Maven |
before 1.73 | 1.73 |
org.bouncycastle:bcprov-jdk15onMaven |
before 1.70 | 1.70 |
org.bouncycastle:bcprov-ext-jdk15onTuxCare:Maven From an advisory covering 3 CVEs |
1.64 up to 1.64-tuxcare.5, plus listed versions 1.64-tuxcare.11.64-tuxcare.21.64-tuxcare.31.64-tuxcare.4 |
1.64-tuxcare.5 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.bouncycastle:bcprov-jdk14TuxCare:Maven From an advisory covering 3 CVEs |
1.64 up to 1.64-tuxcare.5, plus listed versions 1.64-tuxcare.11.64-tuxcare.21.64-tuxcare.31.64-tuxcare.4 |
1.64-tuxcare.5 |
org.bouncycastle:bcprov-jdk15onTuxCare:Maven From an advisory covering 3 CVEs |
1.64 up to 1.64-tuxcare.5, plus listed versions 1.64-tuxcare.11.64-tuxcare.21.64-tuxcare.31.64-tuxcare.4 |
1.64-tuxcare.5 |
org.bouncycastle:bctls-jdk14TuxCare:Maven From an advisory covering 3 CVEs |
1.64 up to 1.64-tuxcare.5, plus listed versions 1.64-tuxcare.11.64-tuxcare.21.64-tuxcare.31.64-tuxcare.4 |
1.64-tuxcare.5 |
bouncycastleDebian:12 |
All versions, plus listed versions 1.72-21.77-11.80-11.80-21.80-31.86-1 |
None known |
bouncycastleDebian:13 |
before 1.77-1 | 1.77-1 |
bouncycastleDebian:14 |
before 1.77-1 | 1.77-1 |
org.bouncycastle:bcprov-ext-jdk16Maven |
before 1.73, plus listed versions 1.451.46 |
1.73 |
org.bouncycastle:bcprov-jdk14Maven |
before 1.73, plus listed versions 1.381.431.441.451.46 Show 24 moreShow less1.471.481.491.501.511.531.541.551.561.571.581.591.601.611.621.631.641.651.671.681.691.701.711.72 |
1.73 |
org.bouncycastle:bcprov-jdk15Maven |
before 1.73, plus listed versions 1.321.381.401.431.441.451.46 |
1.73 |
org.bouncycastle:bcprov-jdk15to18Maven |
before 1.73, plus listed versions 1.631.641.651.661.67 Show 5 moreShow less1.681.691.701.711.72 |
1.73 |
org.bouncycastle:bcprov-jdk16Maven |
before 1.73, plus listed versions 1.381.401.431.441.451.46 |
1.73 |
org.bouncycastle:bcprov-jdk15onMaven |
All versions, plus listed versions 1.461.471.481.491.50 Show 21 moreShow less1.511.521.531.541.551.561.571.581.591.601.611.621.631.641.651.65.011.661.671.681.691.70 |
None known |
org.bouncycastle:bcpkix-jdk18onMaven |
before 1.73, plus listed versions 1.711.71.11.72 |
1.73 |
org.bouncycastle:bcprov-ext-jdk15onMaven |
before 1.73, plus listed versions 1.461.471.481.491.50 Show 20 moreShow less1.511.521.531.541.551.561.571.581.591.601.611.621.631.641.651.661.671.681.691.70 |
1.73 |
org.bouncycastle:bcprov-jdk18onMaven |
before 1.73, plus listed versions 1.711.71.11.72 |
1.73 |
org.bouncycastle:bcprov-jdk15onRoot:Maven |
before 1.70-aikido.3 | 1.70-aikido.31.70-aikido.4 |
io.root.org.bouncycastle:bcprov-jdk15onRoot:Maven |
before 1.70-root.io.3 | 1.70-root.io.31.70-root.io.4 |
bouncycastleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.49+dfsg-3ubuntu11.51-4ubuntu11.51-4ubuntu1+esm1 |
None known |
bouncycastleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.57-11.58-11.59-11.59-1ubuntu0.1~esm1 |
None known |
bouncycastleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.61-11.61-1ubuntu0.1~esm1 |
None known |
bouncycastleUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.68-21.68-41.68-51.68-5ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33202 is a medium vulnerability (CVSS 5.5) in Bouncycastle Bouncy Castle For Java, published November 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in org.bouncycastle:bcprov-jdk18on 1.73.