# CVE-2025-8885: Bouncy Castle for Java on All (API modules) allows Excessive Allocation

> CVE-2025-8885 (GitHub advisory GHSA-67mf-3cr5-8w23) is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3, classed as Allocation of Resources Without Limits or Throttling (CWE-770), in 7 packages, including org.bouncycastle:bcprov-jdk14 (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; and 5 more packages.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-8885

| Field | Value |
| --- | --- |
| CVE | CVE-2025-8885 |
| GHSA | GHSA-67mf-3cr5-8w23 |
| Severity | Medium |
| CVSS 4.0 | 6.3 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber` (GitHub Advisory Database) |
| CWE | CWE-770 Allocation of Resources Without Limits or Throttling |
| EPSS | 0.54% (higher than 43% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 12 Aug 2025 |
| Modified | 12 Sept 2025 |

## Description

A resource allocation vulnerability exists in Bouncy Castle for Java (by Legion of the Bouncy Castle Inc.) that affects all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is located in the ASN1ObjectIdentifier.java file in the core module.

This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.bouncycastle:bcprov-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk14` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk14 | Maven | `pkg:maven/org.bouncycastle/bctls-jdk14` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bctls-jdk15to18` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk18on | Maven | `pkg:maven/org.bouncycastle/bctls-jdk18on` | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bc-fips | Maven | `pkg:maven/org.bouncycastle/bc-fips` | = 2.0.0; >= 1.0.0, < 1.0.2.6 | 1.0.2.6, 2.0.1 |

## Fix commits

- Patch: https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865

## Questions

**What is the GHSA ID for CVE-2025-8885?**

GitHub tracks CVE-2025-8885 as GHSA-67mf-3cr5-8w23.

**What is the CVSS score of CVE-2025-8885?**

CVE-2025-8885 has a CVSS 4.0 base score of 6.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber.

**Which versions are affected by CVE-2025-8885?**

org.bouncycastle:bcprov-jdk14 (Maven): >= 1.0, < 1.78. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.0, < 1.78. org.bouncycastle:bcprov-jdk18on (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk14 (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk15to18 (Maven): >= 1.0, < 1.78. org.bouncycastle:bctls-jdk18on (Maven): >= 1.0, < 1.78. 1 more packages are listed on the page.

**How do I fix CVE-2025-8885?**

Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bctls-jdk14 1.78; and 3 more packages. The fix is in commit 3790993.

**What is the Package URL (PURL) for CVE-2025-8885?**

The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bctls-jdk14, pkg:maven/org.bouncycastle/bctls-jdk15to18 and pkg:maven/org.bouncycastle/bctls-jdk18on and more.

**Is CVE-2025-8885 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-8885. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

## References

- https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865 (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2025-8885 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8885.json (advisory)
- https://github.com/advisories/GHSA-67mf-3cr5-8w23 (advisory)
- https://github.com/bcgit/bc-java (package)
- https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885
- https://repo1.maven.org/maven2/org/bouncycastle

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-8885), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.