CVE-2025-8885
Fixed in a distro release EPSS <1%CVSS 6.3
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Products: Legion of the Bouncy Castle Inc. BC-JAVA, Legion of the Bouncy Castle Inc. BC-FJA
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.bouncycastle:bc-fips | 1.0.2.6 |
| Maven | org.bouncycastle:bc-fips | 2.0.1 |
| Maven | org.bouncycastle:bcprov-jdk14 | 1.78 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | 1.78 |
| Maven | org.bouncycastle:bcprov-jdk18on | 1.78 |
| Maven | org.bouncycastle:bctls-jdk14 | 1.78 |
| Maven | org.bouncycastle:bctls-jdk15to18 | 1.78 |
| Maven | org.bouncycastle:bctls-jdk18on | 1.78 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | bouncycastle-fips-2.0 | 2.0.2-r0 |
| Chainguard | cassandra-fips-4.0 | 4.0.21-r2 |
| Chainguard | cassandra-fips-4.1 | 4.1.12-r2 |
| Chainguard | cassandra-fips-5.0 | 5.0.8-r15 |
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | eco-java-gradle-8.8 | no fix |
| Chainguard | elasticsearch-8.18 | 8.18.6-r12 |
| Chainguard | elasticsearch-8.18-config | 8.18.6-r12 |
| Chainguard | elasticsearch-8.18-iamguarded | 8.18.6-r12 |
| Chainguard | elasticsearch-8.19 | 8.19.2-r12 |
| Chainguard | elasticsearch-8.19-config | 8.19.2-r12 |
| Chainguard | elasticsearch-8.19-iamguarded | 8.19.2-r12 |
| Chainguard | elasticsearch-9.0 | 9.0.7-r0 |
| Chainguard | elasticsearch-9.0-config | 9.0.7-r0 |
| Chainguard | elasticsearch-9.0-iamguarded | 9.0.7-r0 |
| Debian 12 | bouncycastle | no fix |
| Debian 13 | bouncycastle | 1.80-1 |
| Debian 14 | bouncycastle | 1.80-1 |
| Ubuntu 22.04 LTS | bouncycastle | no fix |
| Ubuntu 24.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 16.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 18.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 20.04 LTS | bouncycastle | no fix |