PT-2025-43686 · Unknown+1 · Bouncy Castle For Java+1

Published 2025-10-24 · Updated 2025-10-25 · CVE-2025-12194

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:N/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java FIPS versions 2.1.0 through 2.1.1 Bouncy Castle for Java LTS versions 2.73.0 through 2.73.7

Description An uncontrolled resource consumption issue exists in Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS. The issue involves excessive allocation and is associated with multiple program files including AESNativeCFB.Java, AESNativeGCM.Java, SHA256NativeDigest.Java, AESNativeEngine.Java, AESNativeCBC.Java, AESNativeCTR.Java, AESNativeCFB.Java, AESNativeGCM.Java, AESNativeEngine.Java, AESNativeCBC.Java, AESNativeGCMSIV.Java, AESNativeCCM.Java, AESNativeCTR.Java, SHA256NativeDigest.Java, SHA224NativeDigest.Java, SHA3NativeDigest.Java, SHAKENativeDigest.Java, SHA512NativeDigest.Java, and SHA384NativeDigest.Java.

Recommendations Bouncy Castle for Java FIPS versions 2.1.0 through 2.1.1 should be updated. Bouncy Castle for Java LTS versions 2.73.0 through 2.73.7 should be updated.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-12194

GHSA-JV6H-4262-Q663

Affected Products

Bouncy Castle For Java

Debian

References · 14

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9012194 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-12194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12194 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-12194 · Security Note
• https://ubuntu.com/security/CVE-2025-12194 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv6h-4262-q663 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12194 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12194 · Vendor Advisory
• https://github.com/bcgit/bc-lts-java/commit/f2776feac0c30230f7a5ac34eb24f5019caf0324 · Note
• https://github.com/bcgit/bc-lts-java · Note
• https://github.com/bcgit/bc-lts-java/commit/2c9be6c64152ce48c6afc784c042a514be71ec71 · Note
• https://t.me/cveNotify/140319 · Telegram Post
• https://t.me/CVEtracker/35720 · Telegram Post
• https://twitter.com/CVEnew/status/1981861943448055915 · Twitter Post