CVE-2025-9341
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java, org/bouncycastle/crypto/engines/AESNativeCBC.Java. This issue affects Bouncy Castle for Java FIPS: 2.1.0; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Bouncy Castle for Java FIPS
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- Bouncy Castle for Java FIPS
- Platforms
- All
- Default status
unaffected- Package
- bc-fips
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.1.0 | affected | maven | Unavailable | Unavailable | None listed |
Bouncy Castle for Java LTS
- Vendor
- Legion of the Bouncy Castle Inc.
- Product
- Bouncy Castle for Java LTS
- Platforms
- All
- Default status
unaffected- Package
- bcprov-lts8on
- Package collection
- https://repo1.maven.org/maven2/org/bouncycastle
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.73.0 | affected | maven | Unavailable | 2.73.7 | None listed |