CVE-2025-8916
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
BC Java
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- BC Java
- Platforms
- All
- Default status
unaffected- Package
- bcpkix
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.44 | affected | maven | Unavailable | 1.78 | None listed |
BC Java
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- BC Java
- Platforms
- All
- Default status
unaffected- Package
- bcprov
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.44 | affected | maven | Unavailable | 1.78 | None listed |
BCPKIX FIPS
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- BCPKIX FIPS
- Platforms
- All
- Default status
unaffected- Package
- bcpkix-fips
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.0.0 | affected | maven | Unavailable | 1.0.7 | None listed |
| 2.0.0 | affected | maven | Unavailable | 2.0.7 | None listed |