CVE-2025-8885
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Possible DOS in processing specially formed ASN.1 Object Identifiers
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
BC Java
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- BC Java
- Platforms
- All
- Default status
unaffected- Package
- bcprov
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.0 | affected | maven | Unavailable | 1.77 | None listed |
BC-FJA
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- BC-FJA
- Platforms
- All
- Default status
unaffected- Package
- bc-fips
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.0.0 | affected | maven | Unavailable | 1.0.2.5 | None listed |
| 2.0.0 | affected | maven | Unavailable | 2.0.1 | None listed |