CVE-2025-8916mediumCWE-770

CVE-2025-8916: falha de média gravidade em Legion of the Bouncy Castle Inc. BC Java

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar BC-JAVA+ Monitorar BCPKIX-FIPS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
Produtos afetados
Legion of the Bouncy Castle Inc. · BC JavaLegion of the Bouncy Castle Inc. · BCPKIX FIPS
CVEs relacionadas — Legion of the Bouncy Castle Inc. BC Java

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8885MEDIUMPossible DOS in processing specially formed ASN.1 Object IdentifiersEPSS 0.6%