CVE-2025-8916: Bouncy Castle for Java Excessive Resource Allocation Vulnerability
Summary
CVE-2025-8916: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. Affects org.bouncycastle:bcpkix-jdk15on versions >= 1.44, < 1.79. Fixed in 1.79. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2025-8916 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bouncy Castle for Java is a widely used library that provides cryptographic APIs for Java applications. It includes various modules such as bcpkix, bcprov, and bcpkix-fips, which facilitate secure data handling and encryption. However, certain versions of these modules are vulnerable to excessive resource allocation, which can lead to performance degradation or denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2025-8916 arises from the lack of resource allocation limits in the Bouncy Castle for Java library. Specifically, the bcpkix, bcprov, and bcpkix-fips modules allow for excessive allocation of resources, which can be exploited by attackers to consume system resources, potentially leading to application crashes or degraded performance. This issue is present in versions from BC 1.44 through 1.78, BCPKIX FIPS 1.0.0 through 1.0.7, and BCPKIX FIPS 2.0.0 through 2.0.7.
How To Fix
Minimum fixed version
1.79
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing resource allocation limits in your application to mitigate the risk of excessive resource consumption. This can be done by monitoring resource usage and setting thresholds that trigger alerts or automatic shutdowns of processes that exceed acceptable limits.
Conclusion
CVE-2025-8916 is a significant vulnerability in the Bouncy Castle for Java library that can lead to excessive resource allocation. It is crucial for developers using affected versions to update to the latest patched versions to ensure the security and performance of their applications.
See every vulnerability recorded for org.bouncycastle:bcpkix-jdk15on →
FAQ
CVE-2025-8916 is a vulnerability in the Bouncy Castle for Java library that allows for excessive resource allocation, potentially leading to performance issues or denial of service.
The vulnerability affects Bouncy Castle versions from BC 1.44 through 1.78, BCPKIX FIPS 1.0.0 through 1.0.7, and BCPKIX FIPS 2.0.0 through 2.0.7.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
If you cannot update to the patched versions immediately, implement resource allocation limits in your application as a temporary workaround.
More information can be found in the official advisory and the GitHub repository for Bouncy Castle, where the vulnerability details are documented.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
