VDB
DEBIAN-CVE-2025-8916
DEBIAN-CVE-2025-8916
PUBLISHED
CVSS 6.300000190734863 MEDIUM
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
Risk Scores
CVSS v4.0
6.300000190734863
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:U/V:X/RE:M/U:Amber
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | bouncycastle | 0, 1.80-2, 1.80-3 |
| Debian:12 | bouncycastle | 1.80-3, 0, 1.72-2 |
| Debian:13 | bouncycastle | 0, 0 |
| Debian:14 | bouncycastle | 0, 0 |
Timeline
- Aug 13, 2025 CVE Published
- Apr 28, 2026 CVE Updated