CVE-2025-8916CWE-770

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Medium · published August 13, 2025

CVSS v4.0
6.3
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.

This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-08-13T09:31Z
EPSS history
Timeline
  • 13 AUG 09:31Z
    Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
    cvelistv5