Skip to content
CVE IDCVE-2025-8885GitHub advisory IDGHSA-67mf-3cr5-8w23

Bouncy Castle for Java on All (API modules) allows Excessive Allocation

CVE-2025-8885 (GitHub advisory GHSA-67mf-3cr5-8w23) is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3, classed as Allocation of Resources Without Limits or Throttling (CWE-770), in 7 packages, including org.bouncycastle:bcprov-jdk14 (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; and 5 more packages.

Medium6.3Fix availableGitHub reviewed

Published 12 Aug 2025Updated 12 Sept 2025

6.3MediumCVSS 4.0
CVE ID
CVE-2025-8885
GHSA ID
GHSA-67mf-3cr5-8w23
EPSS
0.54%higher than 43% of CVEs
Weakness (CWE)
  • CWE-770Allocation of Resources Without Limits or Throttling
KEV status
Not in KEV
Published
12 Aug 2025
Updated
12 Sept 2025
Ecosystem
  • Maven
Assigned by (CNA)
bcorg

Summary

Source: OSV (GitHub advisory)

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

Medium6.3Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
Present
Privileges Required PR
None
User Interaction UI
None
Confidentiality (Vulnerable System) VC
None
Integrity (Vulnerable System) VI
None
Availability (Vulnerable System) VA
Low
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None
Safety S
Present
Recovery R
User
Vulnerability Response Effort RE
Moderate
Provider Urgency U
Amber

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • org.bouncycastle:bcprov-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk14
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 34 listed versions
    • 1.38
    • 1.43
    • 1.44
    • 1.45
    • 1.46
    • 1.47
    • 1.48
    • 1.49
    • 1.50
    • 1.51
    • 1.53
    • 1.54
  • org.bouncycastle:bcprov-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk15to18
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 15 listed versions
    • 1.63
    • 1.64
    • 1.65
    • 1.66
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
  • org.bouncycastle:bcprov-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcprov-jdk18on
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 8 listed versions
    • 1.71
    • 1.71.1
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
  • org.bouncycastle:bctls-jdk14
    Maven
    pkg:maven/org.bouncycastle/bctls-jdk14
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 16 listed versions
    • 1.61
    • 1.62
    • 1.63
    • 1.64
    • 1.65
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
  • org.bouncycastle:bctls-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bctls-jdk15to18
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 15 listed versions
    • 1.63
    • 1.64
    • 1.65
    • 1.66
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
  • org.bouncycastle:bctls-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bctls-jdk18on
    Affected versions
    >= 1.0, < 1.78
    Fixed in
    1.78
    Show 8 listed versions
    • 1.71
    • 1.71.1
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
  • org.bouncycastle:bc-fips
    Maven
    pkg:maven/org.bouncycastle/bc-fips
    Affected versions
    = 2.0.0
    >= 1.0.0, < 1.0.2.6
    Fixed in
    1.0.2.6
    2.0.1
    Show 8 listed versions
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.2.1
    • 1.0.2.3
    • 1.0.2.4
    • 1.0.2.5
    • 2.0.0

Fix

Source: OSV (GitHub advisory)

Fix available

  • org.bouncycastle:bcprov-jdk14: upgrade to 1.78 or later
  • org.bouncycastle:bcprov-jdk15to18: upgrade to 1.78 or later
  • org.bouncycastle:bcprov-jdk18on: upgrade to 1.78 or later
  • org.bouncycastle:bctls-jdk14: upgrade to 1.78 or later
  • org.bouncycastle:bctls-jdk15to18: upgrade to 1.78 or later
  • org.bouncycastle:bctls-jdk18on: upgrade to 1.78 or later
  • org.bouncycastle:bc-fips: upgrade to 1.0.2.6 or 2.0.1, depending on your release line

Patch commits

  • 3790993Patch commitgithub.com/bcgit/bc-java

    ASN.1: Limit OID contents to 4096 bytes

    +142 −73 across 3 files

    • core/src/main/java/org/bouncycastle/asn1/ASN1InputStream.java+6 −0
    • core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java+71 −39
    • core/src/main/java/org/bouncycastle/asn1/ASN1RelativeOID.java+65 −34

Vulnerability intelligence

References

Credits

  • xnoxanalyst
  • Bing Shifinder

Questions about CVE-2025-8885

What is the GHSA ID for CVE-2025-8885?
GitHub tracks CVE-2025-8885 as GHSA-67mf-3cr5-8w23.
What is the CVSS score of CVE-2025-8885?
CVE-2025-8885 has a CVSS 4.0 base score of 6.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber.
Which versions are affected by CVE-2025-8885?
org.bouncycastle:bcprov-jdk14 (Maven): >= 1.0, < 1.78. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.0, < 1.78. org.bouncycastle:bcprov-jdk18on (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk14 (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk15to18 (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk18on (Maven): >= 1.0, < 1.78. 1 more packages are listed on the page.
How do I fix CVE-2025-8885?
Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bctls-jdk14 1.78; and 3 more packages. The fix is in commit 3790993.
What is the Package URL (PURL) for CVE-2025-8885?
The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bctls-jdk14, pkg:maven/org.bouncycastle/bctls-jdk15to18 and pkg:maven/org.bouncycastle/bctls-jdk18on and more.
Is CVE-2025-8885 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-8885. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 4 days ago (10 Oct 2026, 04:01 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.