PT-2025-34333 · Unknown · Bouncy Castle For Java

Published 2025-08-22 · Updated 2025-10-24 · CVE-2025-9341

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:N/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions: Bouncy Castle for Java FIPS versions 2.1.0 through 2.1.0

Description: An uncontrolled resource consumption issue exists in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips, affecting all API modules. This issue allows for excessive allocation and is associated with the program file org/bouncycastle/crypto/fips/AESNativeCBC.Java.

Recommendations: Bouncy Castle for Java FIPS version 2.1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-9341

GHSA-JFCV-JV9G-2VX2

Affected Products

Bouncy Castle For Java

References · 8

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909341 · Exploit
• https://osv.dev/vulnerability/GHSA-jfcv-jv9g-2vx2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9341 · Security Note
• https://github.com/bcgit/bc-java · Note
• https://t.me/CVEtracker/30656 · Telegram Post
• https://twitter.com/CVEnew/status/1958826920524562720 · Twitter Post
• https://t.me/cveNotify/140316 · Telegram Post
• https://t.me/cveNotify/133152 · Telegram Post