# CVE-2025-8916: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

> CVE-2025-8916 (GitHub advisory GHSA-4cx2-fc23-5wg6) is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3, classed as Allocation of Resources Without Limits or Throttling (CWE-770), in 4 packages, including org.bouncycastle:bcpkix-jdk15on (Maven) and org.bouncycastle:bcpkix-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcpkix-jdk15on 1.79; org.bouncycastle:bcpkix-jdk15to18 1.79; and 2 more packages.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-8916

| Field | Value |
| --- | --- |
| CVE | CVE-2025-8916 |
| GHSA | GHSA-4cx2-fc23-5wg6 |
| Severity | Medium |
| CVSS 4.0 | 6.3 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber` (GitHub Advisory Database) |
| CWE | CWE-770 Allocation of Resources Without Limits or Throttling |
| EPSS | 0.46% (higher than 37% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact partial |
| Published | 13 Aug 2025 |
| Modified | 13 May 2026 |

## Description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.bouncycastle:bcpkix-jdk15on | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk15on` | >= 1.44, < 1.79 | 1.79 |
| org.bouncycastle:bcpkix-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk15to18` | >= 1.44, < 1.79 | 1.79 |
| org.bouncycastle:bcpkix-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk18on` | >= 1.44, < 1.79 | 1.79 |
| org.bouncycastle:bcpkix-fips | Maven | `pkg:maven/org.bouncycastle/bcpkix-fips` | >= 1.0.0, <= 1.0.7; >= 2.0.0, <= 2.0.7 | 1.0.8, 2.0.8 |

## Fix commits

- Patch: https://github.com/bcgit/bc-java/commit/310b30a4fbf36d13f6cc201ffa7771715641e67e
- Patch: https://github.com/bcgit/bc-java/commit/ff444a479942d88de64004dc82c3ee32a9e9075a

## Questions

**What is the GHSA ID for CVE-2025-8916?**

GitHub tracks CVE-2025-8916 as GHSA-4cx2-fc23-5wg6.

**What is the CVSS score of CVE-2025-8916?**

CVE-2025-8916 has a CVSS 4.0 base score of 6.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber.

**Which versions are affected by CVE-2025-8916?**

org.bouncycastle:bcpkix-jdk15on (Maven): >= 1.44, < 1.79. org.bouncycastle:bcpkix-jdk15to18 (Maven): >= 1.44, < 1.79. org.bouncycastle:bcpkix-jdk18on (Maven): >= 1.44, < 1.79. org.bouncycastle:bcpkix-fips (Maven): >= 1.0.0, <= 1.0.7; >= 2.0.0, <= 2.0.7.

**How do I fix CVE-2025-8916?**

Upgrade each package to its fixed version: org.bouncycastle:bcpkix-jdk15on 1.79; org.bouncycastle:bcpkix-jdk15to18 1.79; org.bouncycastle:bcpkix-jdk18on 1.79; org.bouncycastle:bcpkix-fips 1.0.8 or 2.0.8. The fix is in commits 310b30a and ff444a4.

**What is the Package URL (PURL) for CVE-2025-8916?**

The affected packages' PURLs are pkg:maven/org.bouncycastle/bcpkix-jdk15on, pkg:maven/org.bouncycastle/bcpkix-jdk15to18, pkg:maven/org.bouncycastle/bcpkix-jdk18on and pkg:maven/org.bouncycastle/bcpkix-fips.

**Is CVE-2025-8916 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-8916. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 37% of CVEs.

## References

- https://github.com/bcgit/bc-java/commit/310b30a4fbf36d13f6cc201ffa7771715641e67e (fix)
- https://github.com/bcgit/bc-java/commit/ff444a479942d88de64004dc82c3ee32a9e9075a (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2025-8916 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8916.json (advisory)
- https://github.com/advisories/GHSA-4cx2-fc23-5wg6 (advisory)
- https://github.com/bcgit/bc-java (package)
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908916
- https://repo1.maven.org/maven2/org/bouncycastle

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-8916), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.