CVE-2025-8885: Bouncy Castle for Java Allows Excessive Memory Allocation Leading to Denial of Service
Summary
CVE-2025-8885: Bouncy Castle for Java on All (API modules) allows Excessive Allocation. Affects org.bouncycastle:bcprov-jdk14 versions >= 1.0, < 1.78. Fixed in 1.78. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2025-8885 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptography library for Java, developed by Legion of the Bouncy Castle Inc. It provides a range of APIs for cryptographic operations, including encryption, decryption, and secure communication. The library is known for its flexibility and extensive support for various cryptographic algorithms. However, it has been found to be vulnerable to a resource allocation issue that can lead to excessive memory consumption, potentially causing denial of service.
Vulnerability Detail
A resource allocation vulnerability exists in Bouncy Castle for Java that affects all API modules. This vulnerability allows attackers to exploit the library by causing excessive memory allocation through unbounded resource consumption. The issue is located in the ASN1ObjectIdentifier.java file within the core module, which can lead to denial of service as the application may become unresponsive due to resource exhaustion.
How To Fix
Latest published version: 1.86 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.78
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size or validate the input data before processing it with the Bouncy Castle library to mitigate the risk of excessive memory allocation. Additionally, consider implementing resource limits in your application to prevent denial of service.
Conclusion
The vulnerability CVE-2025-8885 in Bouncy Castle for Java poses a significant risk due to excessive memory allocation, which can lead to denial of service. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk14 →
FAQ
CVE-2025-8885 is a vulnerability in Bouncy Castle for Java that allows excessive memory allocation, potentially leading to denial of service.
The vulnerability affects Bouncy Castle versions from 1.0 through 1.77, as well as BC-FJA versions from 1.0.0 through 2.0.0.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to denial of service, making the application unresponsive due to excessive memory consumption.
Update your project's pom.xml file to include the patched versions of the Bouncy Castle libraries as specified in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk14.
