CVE-2025-8916mediumCWE-770

CVE-2025-8916: fallo de gravedad media en Legion of the Bouncy Castle Inc. BC Java

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BC-JAVA+ Monitorear BCPKIX-FIPS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.5%
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Productos afectados
Legion of the Bouncy Castle Inc. · BC JavaLegion of the Bouncy Castle Inc. · BCPKIX FIPS
CVEs relacionadas — Legion of the Bouncy Castle Inc. BC Java

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-8885MEDIUMPossible DOS in processing specially formed ASN.1 Object IdentifiersEPSS 0.6%