Allocation of Resources Without Limits or Throttling in org.bouncycastle:bcprov-jdk15on | CVE-2025-8916

Q: How to fix?

A fix was pushed into the master branch but not yet published.

Introduced: 13 Aug 2025

NewCVE-2025-8916 (opens in a new tab) CWE-770 (opens in a new tab)

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper processing of large name constraint structures in PKIXCertPathReviewer. An attacker can cause excessive resource allocation by submitting specially crafted ASN.1 objects, potentially leading to service disruption.

Workaround

This vulnerability can be mitigated by limiting the size of ASN.1 objects that can be loaded from untrusted sources, thereby capping the maximum size of a Name Constraints structure.

References

CVSS Base Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
Present
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
None
Integrity (VI)
None
Availability (VA)
Low

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None

Allocation of Resources Without Limits or Throttling Affecting org.bouncycastle:bcprov-jdk15on package, versions [0,]

Severity

Do your applications use this vulnerable package?

Snyk Learn