Skip to content
OpenAdvisories
Medium · 6.3 CVE-2025-8916 EUVD-2025-24555GHSA-4cx2-fc23-5wg6

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Published Aug 13, 2025 · Updated May 12, 2026 · Assigned by bcorg

Vendor: Legion of the Bouncy Castle Product: BC-JAVA Product: BCPKIX-FIPS Package: bouncycastle Package: bouncycastle Package: druid Package: druid-compat Package: gradle-stage0 Package: kserve-modelmesh Package: kserve-modelmesh-compat Package: logstash-8-with-output-opensearch Package: org.bouncycastle:bcpkix-fips Package: org.bouncycastle:bcpkix-jdk15on Package: org.bouncycastle:bcpkix-jdk15to18 Package: org.bouncycastle:bcpkix-jdk18on Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: zipkin Package: zipkin-oci-entrypoint Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.

This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Affected products

VendorProductAffectedFixed
Legion of the Bouncy Castle BC Java 1.44 – ≤ 1.78 —
Legion of the Bouncy Castle BCPKIX FIPS 1.0.0 – ≤ 1.0.7, 2.0.0 – ≤ 2.0.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bouncycastle 1.80-1 —
Debian 13 bouncycastle 1.80-1 —
Debian 12 bouncycastle No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS bouncycastle No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS bouncycastle 1.77-1ubuntu0.1~esm1 —
Ubuntu Pro 20.04 LTS bouncycastle No fix yet —
Ubuntu Pro 18.04 LTS bouncycastle No fix yet —
Ubuntu Pro 16.04 LTS bouncycastle No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling druid +1 34.0.0-r6 —
Wolfi rolling gradle-stage0 +1 No fix yet —
Wolfi rolling kserve-modelmesh +1 0.12.0-r15 —
Wolfi rolling thingsboard +4 4.2.1-r2 —
Wolfi rolling zipkin +2 3.5.1-r7 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bcpkix-fips >= 1.0.0, < 1.0.8 1.0.8 GHSA-4cx2-fc23-5wg6
Maven org.bouncycastle:bcpkix-fips >= 2.0.0, < 2.0.8 2.0.8 GHSA-4cx2-fc23-5wg6
Maven org.bouncycastle:bcpkix-jdk15on >= 1.44, < 1.79 1.79 GHSA-4cx2-fc23-5wg6
Maven org.bouncycastle:bcpkix-jdk15to18 >= 1.44, < 1.79 1.79 GHSA-4cx2-fc23-5wg6
Maven org.bouncycastle:bcpkix-jdk18on >= 1.44, < 1.79 1.79 GHSA-4cx2-fc23-5wg6

Advisories 17

References