Description
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java, org/bouncycastle/crypto/engines/AESNativeCBC.Java.
This issue affects Bouncy Castle for Java FIPS: 2.1.0; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Legion of the Bouncy Castle | Bouncy Castle for Java FIPS | 2.1.0 | — |
| Legion of the Bouncy Castle | Bouncy Castle for Java LTS | 2.73.0 – ≤ 2.73.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bc-fips | >= 2.1.0, < 2.1.1 | 2.1.1 | GHSA-jfcv-jv9g-2vx2 |
| Maven | org.bouncycastle:bctls-fips | >= 2.73.7, < 2.73.8 | 2.73.8 | GHSA-jfcv-jv9g-2vx2 |
Advisories 1
- WID-SEC-2025-1895 Bouncy Castle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2025