CVE-2025-8916
Fixed in a distro release EPSS <1%CVSS 6.3
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
Products: Legion of the Bouncy Castle Inc. BC-JAVA, Legion of the Bouncy Castle Inc. BCPKIX FIPS, Siemens SIMATIC CN 4100
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.bouncycastle:bcpkix-fips | 1.0.8 |
| Maven | org.bouncycastle:bcpkix-fips | 2.0.8 |
| Maven | org.bouncycastle:bcpkix-jdk15on | 1.79 |
| Maven | org.bouncycastle:bcpkix-jdk15to18 | 1.79 |
| Maven | org.bouncycastle:bcpkix-jdk18on | 1.79 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-zeebe-8.3 | 8.3.22-r9 |
| Chainguard | camunda-zeebe-8.3-compat | 8.3.22-r9 |
| Chainguard | camunda-zeebe-8.4 | 8.4.21-r8 |
| Chainguard | camunda-zeebe-8.4-compat | 8.4.21-r8 |
| Chainguard | camunda-zeebe-8.5 | 8.5.25-r1 |
| Chainguard | camunda-zeebe-8.5-compat | 8.5.25-r1 |
| Chainguard | camunda-zeebe-8.6 | 8.6.29-r1 |
| Chainguard | camunda-zeebe-8.6-compat | 8.6.29-r1 |
| Chainguard | camunda-zeebe-8.7 | 8.7.16-r0 |
| Chainguard | camunda-zeebe-8.7-compat | 8.7.16-r0 |
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | druid | 34.0.0-r6 |
| Chainguard | druid-compat | 34.0.0-r6 |
| Chainguard | eco-java-gradle-6.0 | no fix |
| Chainguard | eco-java-gradle-6.0.1 | no fix |
| Chainguard | eco-java-gradle-6.1 | no fix |
| Chainguard | eco-java-gradle-6.1.1 | no fix |
| Chainguard | eco-java-gradle-6.2 | no fix |
| Chainguard | eco-java-gradle-6.2.1 | no fix |
| Chainguard | eco-java-gradle-6.2.2 | no fix |
| Chainguard | eco-java-gradle-6.3 | no fix |
| Chainguard | eco-java-gradle-6.4 | no fix |
| Chainguard | eco-java-gradle-6.4.1 | no fix |
| Chainguard | eco-java-gradle-6.5 | no fix |
| Chainguard | eco-java-gradle-6.5.1 | no fix |
| Chainguard | eco-java-gradle-6.6 | no fix |
| Chainguard | eco-java-gradle-6.6.1 | no fix |
| Chainguard | eco-java-gradle-6.7 | no fix |
| Chainguard | eco-java-gradle-6.7.1 | no fix |
| Chainguard | eco-java-gradle-6.8 | no fix |
| Chainguard | eco-java-gradle-6.8.1 | no fix |
| Chainguard | eco-java-gradle-6.8.2 | no fix |
| Chainguard | eco-java-gradle-6.8.3 | no fix |
| Chainguard | eco-java-gradle-6.9 | no fix |
| Chainguard | eco-java-gradle-6.9.1 | no fix |
| Chainguard | eco-java-gradle-6.9.2 | no fix |
| Chainguard | eco-java-gradle-6.9.3 | no fix |
| Chainguard | eco-java-gradle-6.9.4 | no fix |
| Chainguard | eco-java-gradle-7.0 | no fix |
| Chainguard | eco-java-gradle-7.0.1 | no fix |
| Chainguard | eco-java-gradle-7.0.2 | no fix |
| Chainguard | eco-java-gradle-7.1 | no fix |
| Chainguard | eco-java-gradle-7.1.1 | no fix |
| Chainguard | eco-java-gradle-7.2 | no fix |
| Chainguard | eco-java-gradle-7.3 | no fix |
| Chainguard | eco-java-gradle-7.3.1 | no fix |
| Chainguard | eco-java-gradle-7.3.2 | no fix |
| Chainguard | eco-java-gradle-7.3.3 | no fix |
| Chainguard | eco-java-gradle-7.4 | no fix |
| Chainguard | eco-java-gradle-7.4.1 | no fix |
| Chainguard | eco-java-gradle-7.4.2 | no fix |
| Chainguard | eco-java-gradle-7.5 | no fix |
| Chainguard | eco-java-gradle-7.5.1 | no fix |
| Chainguard | eco-java-gradle-7.6 | no fix |
| Chainguard | eco-java-gradle-7.6.1 | no fix |
| Chainguard | eco-java-gradle-7.6.2 | no fix |
| Chainguard | eco-java-gradle-7.6.3 | no fix |
| Chainguard | eco-java-gradle-7.6.4 | no fix |
| Chainguard | eco-java-gradle-8.0 | no fix |
| Chainguard | eco-java-gradle-8.0.1 | no fix |
| Chainguard | eco-java-gradle-8.0.2 | no fix |
| Chainguard | eco-java-gradle-8.1 | no fix |
| Chainguard | eco-java-gradle-8.1.1 | no fix |
| Chainguard | eco-java-gradle-8.2 | no fix |
| Chainguard | eco-java-gradle-8.2.1 | no fix |
| Chainguard | eco-java-gradle-8.3 | no fix |
| Chainguard | eco-java-gradle-8.4 | no fix |
| Chainguard | eco-java-gradle-8.5 | no fix |
| Chainguard | eco-java-gradle-8.6 | no fix |
| Chainguard | elasticsearch-7 | 7.17.29-r5 |
| Chainguard | elasticsearch-7-iamguarded | 7.17.29-r5 |
| Chainguard | elasticsearch-8.17 | 8.17.10-r14 |
| Chainguard | elasticsearch-8.17 | 8.17.10-r20 |
| Chainguard | elasticsearch-fips-8.17 | 8.17.10-r1 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r1 |
| Chainguard | elasticsearch-fips-8.17-config | 8.17.10-r1 |
| Chainguard | gradle-stage0 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.4.2 | 3.4.2-r5 |
| Chainguard | hadoop-fips-3.5 | no fix |
| Chainguard | jenkins-2.462 | 2.462.3-r9 |
| Chainguard | kayenta-2025.0 | 2025.0.8-r1 |
| Chainguard | kayenta-2025.1 | 2025.1.5-r1 |
| Chainguard | kayenta-fips-2025.0 | 2025.0.8-r1 |
| Chainguard | kayenta-fips-2025.1 | 2025.1.5-r1 |
| Chainguard | kserve-modelmesh | 0.12.0-r15 |
| Chainguard | kserve-modelmesh-compat | 0.12.0-r15 |
| Chainguard | logstash-8-with-output-opensearch | no fix |
| Chainguard | logstash-8.17 | no fix |
| Chainguard | logstash-8.17-iamguarded-compat | no fix |
| Chainguard | logstash-8.17-with-output-opensearch | no fix |
| Chainguard | logstash-8.18 | no fix |
| Chainguard | logstash-8.18-iamguarded-compat | no fix |
| Chainguard | logstash-8.18-with-output-opensearch | no fix |
| Chainguard | logstash-8.19 | 8.19.19-r0 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.19-r0 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.19-r0 |
| Chainguard | logstash-9.0 | no fix |
| Chainguard | logstash-9.0-iamguarded-compat | no fix |
| Chainguard | logstash-9.0-with-output-opensearch | no fix |
| Chainguard | neo4j-4.4 | 4.4.44-r4 |
| Chainguard | neo4j-4.4-docker-publish | 4.4.44-r4 |
| Chainguard | opensearch-2-performance-analyzer | 2.19.4-r0 |
| Chainguard | opensearch-2-security | 2.19.4-r0 |
| Chainguard | pinot | 1.5.0-r0 |
| Chainguard | pinot-fips | 1.5.0-r0 |
| Chainguard | solr-9-full | 9.10.1-r14 |
| Chainguard | thingsboard | 4.2.1-r2 |
| Chainguard | thingsboard-tb-js-executor | 4.2.1-r2 |
| Chainguard | thingsboard-tb-mqtt-transport | 4.2.1-r2 |
| Chainguard | thingsboard-tb-node | 4.2.1-r2 |
| Chainguard | thingsboard-tb-web-ui | 4.2.1-r2 |
| Chainguard | zipkin | 3.5.1-r7 |
| Chainguard | zipkin-oci-entrypoint | 3.5.1-r7 |
| Chainguard | zipkin-slim | 3.5.1-r7 |
| Debian 12 | bouncycastle | no fix |
| Debian 13 | bouncycastle | 1.80-1 |
| Debian 14 | bouncycastle | 1.80-1 |
| Ubuntu 22.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 16.04 LTS | bouncycastle | 1.51-4ubuntu1+esm1 |
| Ubuntu Pro 16.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 18.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 18.04 LTS | bouncycastle | 1.59-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | bouncycastle | no fix |
| Ubuntu Pro 20.04 LTS | bouncycastle | 1.61-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | bouncycastle | 1.68-5ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | bouncycastle | 1.77-1ubuntu0.1~esm1 |
| Wolfi | druid | 34.0.0-r6 |
| Wolfi | druid-compat | 34.0.0-r6 |
| Wolfi | gradle-stage0 | no fix |
| Wolfi | kserve-modelmesh | 0.12.0-r15 |
| Wolfi | kserve-modelmesh-compat | 0.12.0-r15 |
| Wolfi | logstash-8-with-output-opensearch | no fix |
| Wolfi | thingsboard | 4.2.1-r2 |
| Wolfi | thingsboard-tb-js-executor | 4.2.1-r2 |
| Wolfi | thingsboard-tb-mqtt-transport | 4.2.1-r2 |
| Wolfi | thingsboard-tb-node | 4.2.1-r2 |
| Wolfi | thingsboard-tb-web-ui | 4.2.1-r2 |
| Wolfi | zipkin | 3.5.1-r7 |
| Wolfi | zipkin-oci-entrypoint | 3.5.1-r7 |
| Wolfi | zipkin-slim | 3.5.1-r7 |