CVE-2025-9341mediumCWE-400

CVE-2025-9341: falha de média gravidade em Legion of the Bouncy Castle Inc.

Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Bouncy Castle for Java+ Monitorar Bouncy Castle for Java FIPS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.2%
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java, org/bouncycastle/crypto/engines/AESNativeCBC.Java. This issue affects Bouncy Castle for Java FIPS: 2.1.0; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:N/R:U/V:C/RE:M/U:Amber
Produtos afetados
Legion of the Bouncy Castle Inc. · Bouncy Castle for Java FIPSLegion of the Bouncy Castle Inc. · Bouncy Castle for Java LTS
CVEs relacionadas — Legion of the Bouncy Castle Inc.

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12194MEDIUMCVE-2025-12194EPSS 0.2%