Bouncy Castle: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.9
  CVE-2025-9341

  Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion

  Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Alloc…

  Legion of the Bouncy Castle Bouncy Castle for Java LTS Bouncy Castle for Java FIPS org.bouncycastle:bc-fips Maven
  Aug 22, 2025
• None 0.0
  CVE-2025-9340

  native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.

  Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Ja…

  Legion of the Bouncy Castle Bouncy Castle for Java org.bouncycastle:bc-fips Maven
  Aug 22, 2025

Revision history

1. 2025-08-24 #2

   Referenz(en) aufgenommen: EUVD-2025-25504, EUVD-2025-25505

2. 2025-08-21 #1

   Initiale Fassung

References

• CVE‐2025‐9340 · bcgit/bc-java Wiki · GitHub vom 2025-08-22
  https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909340
• CVE‐2025‐9341 · bcgit/bc-java Wiki · GitHub vom 2025-08-22
  https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909341