CVE-2025-8916
Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
CVE-2025-8916- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-24555
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
EUVD-2025-24555- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4cx2-fc23-5wg6
Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .
This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
- Record
GHSA-4cx2-fc23-5wg6- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
CVE-2025-8916- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
CVE-2025-8916- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-8916
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
DEBIAN-CVE-2025-8916- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-4cx2-fc23-5wg6
Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .
This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
- Record
GHSA-4cx2-fc23-5wg6- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-8916
CVE-2025-8916 in org.bouncycastle:bcpkix-jdk18on - Patched by Root
Root has patched CVE-2025-8916 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-8916- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-8916
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
- Record
UBUNTU-CVE-2025-8916- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber - Updated
- 2026-11-02
OSVCLSA-2026-1770336550 No score
TuxCare security update for org.bouncycastle (1 CVE)
TuxCare rebuilt 2 org.bouncycastle packages to address 1 CVE. Fixed in 1.76-tuxcare.2.
- Record
CLSA-2026-1770336550- Updated
- 2026-11-02
OSVCLSA-2026-1773101690 No score
TuxCare security update for org.bouncycastle (2 CVEs)
TuxCare rebuilt 4 org.bouncycastle packages to address 2 CVEs. Fixed in 1.64-tuxcare.1.
- Record
CLSA-2026-1773101690- Updated
- 2026-11-02
OSVCLSA-2026-1791306023 No score
TuxCare security update for org.bouncycastle (7 CVEs)
TuxCare rebuilt 11 org.bouncycastle packages to address 7 CVEs. Fixed in 1.77-tuxcare.3.
- Record
CLSA-2026-1791306023- Updated
- 2026-11-02
OSVCLSA-2026-1793133867 No score
TuxCare security update for org.bouncycastle (1 CVE)
TuxCare rebuilt 2 org.bouncycastle packages to address 1 CVE. Fixed in 1.75-tuxcare.2.
- Record
CLSA-2026-1793133867- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.bouncycastle:bcpkix-fipsMaven |
1.0.0 to 1.0.7 | 1.0.8 |
org.bouncycastle:bcpkix-fipsMaven |
2.0.0 to 2.0.7 | 2.0.8 |
org.bouncycastle:bcpkix-jdk15onMaven |
1.44 up to 1.79 | 1.79 |
org.bouncycastle:bcpkix-jdk15to18Maven |
1.44 up to 1.79 | 1.79 |
org.bouncycastle:bcpkix-jdk18onMaven |
1.44 up to 1.79 | 1.79 |
org.bouncycastle:bcpkix-jdk15to18TuxCare:Maven |
1.76 up to 1.76-tuxcare.2, plus listed versions 1.76-tuxcare.1 |
1.76-tuxcare.2 |
org.bouncycastle:bcpkix-jdk18onTuxCare:Maven |
1.76 up to 1.76-tuxcare.2, plus listed versions 1.76-tuxcare.1 |
1.76-tuxcare.2 |
org.bouncycastle:bcpkix-jdk15onTuxCare:Maven From an advisory covering 2 CVEs |
1.64 up to 1.64-tuxcare.1 | 1.64-tuxcare.1 |
org.bouncycastle:bcprov-ext-jdk15onTuxCare:Maven From an advisory covering 2 CVEs |
1.64 up to 1.64-tuxcare.1 | 1.64-tuxcare.1 |
org.bouncycastle:bcprov-jdk14TuxCare:Maven From an advisory covering 2 CVEs |
1.64 up to 1.64-tuxcare.1 | 1.64-tuxcare.1 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.bouncycastle:bcprov-jdk15onTuxCare:Maven From an advisory covering 2 CVEs |
1.64 up to 1.64-tuxcare.1 | 1.64-tuxcare.1 |
org.bouncycastle:bcpkix-debug-jdk15to18TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcpkix-debug-jdk18onTuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcpkix-jdk14TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcpkix-jdk15to18TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcpkix-jdk18onTuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcprov-jdk14TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcprov-jdk15to18TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcprov-jdk18onTuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bctls-jdk14TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bctls-jdk15to18TuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bctls-jdk18onTuxCare:Maven From an advisory covering 7 CVEs |
1.77 up to 1.77-tuxcare.3, plus listed versions 1.77-tuxcare.11.77-tuxcare.2 |
1.77-tuxcare.3 |
org.bouncycastle:bcpkix-jdk15to18TuxCare:Maven |
1.75 up to 1.75-tuxcare.2, plus listed versions 1.75-tuxcare.1 |
1.75-tuxcare.2 |
org.bouncycastle:bcpkix-jdk18onTuxCare:Maven |
1.75 up to 1.75-tuxcare.2, plus listed versions 1.75-tuxcare.1 |
1.75-tuxcare.2 |
bouncycastleDebian:12 |
All versions, plus listed versions 1.72-21.77-11.80-11.80-21.80-3 |
None known |
bouncycastleDebian:13 |
before 1.80-1 | 1.80-1 |
bouncycastleDebian:14 |
before 1.80-1 | 1.80-1 |
org.bouncycastle:bcpkix-jdk15onMaven |
1.44 up to 1.79, plus listed versions 1.471.481.491.501.51 Show 19 moreShow less1.521.531.541.551.561.571.581.591.601.611.621.631.641.651.661.671.681.691.70 |
1.79 |
org.bouncycastle:bcpkix-jdk15to18Maven |
1.44 up to 1.79, plus listed versions 1.631.641.651.661.67 Show 12 moreShow less1.681.691.701.711.721.731.741.751.761.771.781.78.1 |
1.79 |
org.bouncycastle:bcpkix-jdk18onMaven |
1.44 up to 1.79, plus listed versions 1.711.71.11.721.731.74 Show 5 moreShow less1.751.761.771.781.78.1 |
1.79 |
org.bouncycastle:bcpkix-fipsMaven |
1.0.0 up to 1.0.8, plus listed versions 1.0.11.0.21.0.31.0.41.0.51.0.61.0.7 |
1.0.8 |
org.bouncycastle:bcpkix-fipsMaven |
2.0.0 up to 2.0.8, plus listed versions 2.0.7 |
2.0.8 |
org.bouncycastle:bcpkix-jdk18onRoot:Maven |
before 1.77-aikido.6 | 1.77-aikido.61.78.1-aikido.151.78-aikido.31.77-aikido.51.78.1-aikido.131.75-aikido.51.78-aikido.21.77-aikido.11.78-aikido.11.78.1-aikido.141.77-aikido.21.77-aikido.31.77-aikido.41.79-aikido.71.79-aikido.6 |
org.bouncycastle:bcpkix-jdk15onRoot:Maven |
before 1.70-aikido.3 | 1.70-aikido.31.70-aikido.4 |
io.root.org.bouncycastle:bcpkix-jdk18onRoot:Maven |
before 1.78.1-root.io.1 | 1.78.1-root.io.11.78.1-root.io.21.78.1-root.io.31.78.1-root.io.41.78.1-root.io.51.78.1-root.io.61.78.1-root.io.71.78.1-root.io.81.78.1-root.io.91.78.1-root.io.101.78.1-root.io.111.78.1-root.io.121.77-root.io.61.78.1-root.io.151.78-root.io.31.77-root.io.51.78.1-root.io.131.75-root.io.51.78-root.io.21.77-root.io.11.78-root.io.11.78.1-root.io.141.77-root.io.21.77-root.io.31.77-root.io.41.79-root.io.11.79-root.io.21.79-root.io.31.79-root.io.41.79-root.io.51.79-root.io.71.79-root.io.6 |
io.root.org.bouncycastle:bcpkix-jdk15onRoot:Maven |
before 1.70-root.io.3 | 1.70-root.io.31.70-root.io.4 |
bouncycastleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.49+dfsg-3ubuntu11.51-4ubuntu11.51-4ubuntu1+esm1 |
None known |
bouncycastleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.57-11.58-11.59-11.59-1ubuntu0.1~esm1 |
None known |
bouncycastleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.61-11.61-1ubuntu0.1~esm1 |
None known |
bouncycastleUbuntu:22.04:LTS |
All versions, plus listed versions 1.68-21.68-41.68-5 |
None known |
bouncycastleUbuntu:Pro:24.04:LTS |
before 1.77-1ubuntu0.1~esm1, plus listed versions 1.72-21.77-1 |
1.77-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8916 is a medium vulnerability (CVSS 6.3) in Legion Of The Bouncy Castle Inc. Bc Java, published August 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in org.bouncycastle:bcpkix-fips 1.0.8.
References
github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908916
cert-portal.siemens.com/productcert/html/ssa-032379.html
nvd.nist.gov/vuln/detail/CVE-2025-8916