Every CVE Search/ Get API key

CVE-2025-8885

Possible DOS in processing specially formed ASN.1 Object Identifiers

6.3 MediumFix available

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.59%Up 0.5 points since Aug 12, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.3

Possible DOS in processing specially formed ASN.1 Object Identifiers

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
CVE-2025-8885
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-24231 6.3

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
EUVD-2025-24231
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Updated
2026-11-02
GitHub AdvisoriesGHSA-67mf-3cr5-8w23 6.3

Bouncy Castle for Java on All (API modules) allows Excessive Allocation

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

Record
GHSA-67mf-3cr5-8w23
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Weakness
CWE-770
Updated
2026-11-02
NVD 6.3

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
CVE-2025-8885
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber
Weakness
CWE-770
Updated
2026-11-02
OSV 6.3

Possible DOS in processing specially formed ASN.1 Object Identifiers

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
CVE-2025-8885
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Weakness
CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2025-8885 6.3

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
DEBIAN-CVE-2025-8885
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-67mf-3cr5-8w23 6.3

Bouncy Castle for Java on All (API modules) allows Excessive Allocation

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

Record
GHSA-67mf-3cr5-8w23
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Weakness
CWE-770
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-8885 5.3

CVE-2025-8885 in org.bouncycastle:bc-fips - Patched by Root

Root has patched CVE-2025-8885 in the org.bouncycastle:bc-fips package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-8885
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-8885 6.3

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Record
UBUNTU-CVE-2025-8885
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Updated
2026-11-02
OSVCLSA-2026-1769818135 No score

TuxCare security update for org.bouncycastle (5 CVEs)

TuxCare rebuilt 4 org.bouncycastle packages to address 5 CVEs. Fixed in 1.76-tuxcare.1.

Record
CLSA-2026-1769818135
Updated
2026-11-02
OSVCLSA-2026-1791306023 No score

TuxCare security update for org.bouncycastle (7 CVEs)

TuxCare rebuilt 11 org.bouncycastle packages to address 7 CVEs. Fixed in 1.77-tuxcare.3.

Record
CLSA-2026-1791306023
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.bouncycastle:bcprov-jdk14
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bcprov-jdk15to18
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bcprov-jdk18on
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bctls-jdk14
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bctls-jdk15to18
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bctls-jdk18on
Maven
 1.0 up to 1.78
1.78
org.bouncycastle:bc-fips
Maven
 2.0.0 to 2.0.0
2.0.1
org.bouncycastle:bc-fips
Maven
 1.0.0 up to 1.0.2.6
1.0.2.6
org.bouncycastle:bcprov-jdk15to18
TuxCare:Maven
From an advisory covering 5 CVEs
 1.76 up to 1.76-tuxcare.1
1.76-tuxcare.1
org.bouncycastle:bcprov-jdk18on
TuxCare:Maven
From an advisory covering 5 CVEs
 1.76 up to 1.76-tuxcare.1
1.76-tuxcare.1
Show 33 moreShow less
Affected packages
PackageAffectedFixed
org.bouncycastle:bctls-jdk15to18
TuxCare:Maven
From an advisory covering 5 CVEs
 1.76 up to 1.76-tuxcare.1
1.76-tuxcare.1
org.bouncycastle:bctls-jdk18on
TuxCare:Maven
From an advisory covering 5 CVEs
 1.76 up to 1.76-tuxcare.1
1.76-tuxcare.1
org.bouncycastle:bcpkix-debug-jdk15to18
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcpkix-debug-jdk18on
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcpkix-jdk14
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcpkix-jdk15to18
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcpkix-jdk18on
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcprov-jdk14
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcprov-jdk15to18
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bcprov-jdk18on
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bctls-jdk14
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bctls-jdk15to18
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
org.bouncycastle:bctls-jdk18on
TuxCare:Maven
From an advisory covering 7 CVEs
 1.77 up to 1.77-tuxcare.3, plus listed versions
1.77-tuxcare.11.77-tuxcare.2
1.77-tuxcare.3
bouncycastle
Debian:12
 All versions, plus listed versions
1.72-21.77-11.80-11.80-21.80-3
 None known
bouncycastle
Debian:13
 before 1.80-1
1.80-1
bouncycastle
Debian:14
 before 1.80-1
1.80-1
org.bouncycastle:bcprov-jdk14
Maven
 1.0 up to 1.78, plus listed versions
1.381.431.441.451.46
Show 29 moreShow less
1.471.481.491.501.511.531.541.551.561.571.581.591.601.611.621.631.641.651.671.681.691.701.711.721.731.741.751.761.77
1.78
org.bouncycastle:bcprov-jdk15to18
Maven
 1.0 up to 1.78, plus listed versions
1.631.641.651.661.67
Show 10 moreShow less
1.681.691.701.711.721.731.741.751.761.77
1.78
org.bouncycastle:bcprov-jdk18on
Maven
 1.0 up to 1.78, plus listed versions
1.711.71.11.721.731.741.751.761.77
1.78
org.bouncycastle:bctls-jdk14
Maven
 1.0 up to 1.78, plus listed versions
1.611.621.631.641.65
Show 11 moreShow less
1.671.681.691.701.711.721.731.741.751.761.77
1.78
org.bouncycastle:bctls-jdk15to18
Maven
 1.0 up to 1.78, plus listed versions
1.631.641.651.661.67
Show 10 moreShow less
1.681.691.701.711.721.731.741.751.761.77
1.78
org.bouncycastle:bctls-jdk18on
Maven
 1.0 up to 1.78, plus listed versions
1.711.71.11.721.731.741.751.761.77
1.78
org.bouncycastle:bc-fips
Maven
 1.0.0 up to 1.0.2.6, plus listed versions
1.0.11.0.21.0.2.11.0.2.31.0.2.41.0.2.5
1.0.2.6
org.bouncycastle:bc-fips
Maven
 2.0.0 up to 2.0.1
2.0.1
org.bouncycastle:bc-fips
Root:Maven
 before 1.0.2.5-aikido.9307
1.0.2.5-aikido.93071.0.2.5-aikido.41.0.2.6-aikido.1
org.bouncycastle:bcprov-jdk18on
Root:Maven
 before 1.77-aikido.6
1.77-aikido.61.77-aikido.51.75-aikido.41.78-aikido.31.78-aikido.2
io.root.org.bouncycastle:bc-fips
Root:Maven
 before 1.0.2.5-root.io.9307
1.0.2.5-root.io.93071.0.2.5-root.io.11.0.2.5-root.io.21.0.2.5-root.io.31.0.2.5-root.io.41.0.2.6-root.io.1
io.root.org.bouncycastle:bcprov-jdk18on
Root:Maven
 before 1.77-root.io.6
1.77-root.io.61.77-root.io.51.75-root.io.41.78-root.io.31.78-root.io.2
bouncycastle
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.49+dfsg-3ubuntu11.51-4ubuntu11.51-4ubuntu1+esm1
 None known
bouncycastle
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.57-11.58-11.59-11.59-1ubuntu0.1~esm1
 None known
bouncycastle
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.61-11.61-1ubuntu0.1~esm1
 None known
bouncycastle
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.68-21.68-41.68-5
 None known
bouncycastle
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.72-21.77-1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8885 is a medium vulnerability (CVSS 6.3) in Legion Of The Bouncy Castle Inc. Bc Java, published August 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in org.bouncycastle:bcprov-jdk14 1.78.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open