Skip to content
OpenAdvisories
Medium · 5.9 CVE-2025-12194 EUVD-2025-35896GHSA-jv6h-4262-q663

Bouncy Castle Vulnerable to Uncontrolled Resource Consumption

Published Oct 24, 2025 · Updated Oct 27, 2025 · Assigned by bcorg

Vendor: Legion of the Bouncy Castle Product: Bouncy Castle for Java FIPS Product: Bouncy Castle for Java LTS Package: bouncycastle Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-analysis-icu Package: opensearch-3-analysis-kuromoji Package: opensearch-3-analysis-nori Package: opensearch-3-analysis-phonetic Package: opensearch-3-analysis-smartcn Package: opensearch-3-analysis-stempel Package: opensearch-3-analysis-ukrainian Package: opensearch-3-anomaly-detection Package: opensearch-3-asynchronous-search Package: opensearch-3-cross-cluster-replication Package: opensearch-3-crypto-kms Package: opensearch-3-custom-codecs Package: opensearch-3-discovery-azure-classic Package: opensearch-3-discovery-ec2 Package: opensearch-3-discovery-gce Package: opensearch-3-geospatial Package: opensearch-3-index-management Package: opensearch-3-ingest-attachment Package: opensearch-3-job-scheduler Package: opensearch-3-k-nn Package: opensearch-3-mapper-annotated-text Package: opensearch-3-mapper-murmur3 Package: opensearch-3-mapper-size Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-observability Package: opensearch-3-performance-analyzer Package: opensearch-3-reporting Package: opensearch-3-repository-azure Package: opensearch-3-repository-gcs Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-security-analytics Package: opensearch-3-sql Package: opensearch-3-store-smb Package: opensearch-3-telemetry-otel Package: org.bouncycastle:bc-fips Package: org.bouncycastle:bcprov-debug-lts8on Ecosystem: Debian Ecosystem: Maven Ecosystem: Wolfi

Description

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java.

This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.

Affected products

VendorProductAffectedFixed
Legion of the Bouncy Castle Bouncy Castle for Java FIPS 2.1.0 – ≤ 2.1.1 —
Legion of the Bouncy Castle Bouncy Castle for Java LTS 2.73.0 – ≤ 2.73.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bouncycastle No fix yet —
Debian 13 bouncycastle No fix yet —
Debian 12 bouncycastle No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling opensearch-3 +38 3.3.2-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bc-fips >= 2.1.0, < 2.1.2 2.1.2 GHSA-jv6h-4262-q663
Maven org.bouncycastle:bcprov-debug-lts8on >= 2.73.0, < 2.73.8 2.73.8 GHSA-jv6h-4262-q663

Advisories 1

References