Description
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .
This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Legion of the Bouncy Castle | BC Java | 1.0 – ≤ 1.77 | — |
| Legion of the Bouncy Castle | BC-FJA | 1.0.0 – ≤ 1.0.2.5, 2.0.0 – ≤ 2.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.80-1 | — |
| Debian 13 | bouncycastle | 1.80-1 | — |
| Debian 12 | bouncycastle | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu 22.04 LTS | bouncycastle | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 18.04 LTS | bouncycastle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | bouncycastle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bc-fips | >= 1.0.0, < 1.0.2.6 | 1.0.2.6 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bc-fips | >= 2.0.0, < 2.0.1 | 2.0.1 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bcprov-jdk14 | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bcprov-jdk18on | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bctls-jdk14 | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bctls-jdk15to18 | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
| Maven | org.bouncycastle:bctls-jdk18on | >= 1.0, < 1.78 | 1.78 | GHSA-67mf-3cr5-8w23 |
Advisories 3
- WID-SEC-2025-1764 Bouncy Castle: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 13, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- NCSC-2025-0328 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 23, 2025