CVE-2025-8916: Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.
This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
Other sources
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .
This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8916?
CVE-2025-8916 is classified as a high severity vulnerability due to its potential for excessive resource allocation.
How do I fix CVE-2025-8916?
To fix CVE-2025-8916, upgrade to the latest version of Bouncy Castle for Java or apply any security patches provided by the vendor.
What applications are affected by CVE-2025-8916?
CVE-2025-8916 affects Bouncy Castle for Java versions between 1.44 and 1.78, as well as specific versions of BCPKIX FIPS.
What types of vulnerabilities are related to CVE-2025-8916?
CVE-2025-8916 is related to allocation of resources without limits, which can lead to application denial of service.
When was CVE-2025-8916 disclosed?
The disclosure date for CVE-2025-8916 has not been explicitly mentioned, but it is included in ongoing discussions related to Bouncy Castle security.