PT-2025-32637 · Unknown+1 · Bouncy Castle For Java+1

Bing Shi · Published 2025-08-12 · Updated 2025-09-12 · CVE-2025-8885

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions: Bouncy Castle for Java versions 1.0 through 1.77 Bouncy Castle for Java - FJA versions 1.0.0 through 2.0.0

Description: A resource allocation issue exists in Bouncy Castle for Java affecting all API modules. The vulnerability allows attackers to cause excessive memory allocation through unbounded resource consumption, potentially leading to denial of service. The issue is associated with the ASN1ObjectIdentifier.java file within the core module and is triggered by malformed ASN.1 OIDs.

Recommendations: Bouncy Castle for Java versions prior to 1.78 Bouncy Castle for Java - FJA versions prior to 2.0.1

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-8885

GHSA-67MF-3CR5-8W23

Affected Products

Bouncy Castle For Java

Debian

References · 18

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8885 · Security Note
• https://ubuntu.com/security/CVE-2025-8885 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8885 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8885 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8885 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67mf-3cr5-8w23 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8885 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-8885 · Security Note
• https://github.com/bcgit/bc-java · Note
• https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java · Note
• https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865 · Note
• https://t.me/cveNotify/132576 · Telegram Post
• https://t.me/cveNotify/135225 · Telegram Post
• https://twitter.com/MxScripter/status/1955254743980220540 · Twitter Post