Excessive Resource Allocation Vulnerability in Bouncy Castle Package
Summary
CVE-2025-8885: Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Affects bouncycastle versions 1.68-2 – 1.80-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptography library in Java that provides a range of APIs for encryption, decryption, and secure data handling. It is known for its flexibility and extensive support for various cryptographic algorithms. However, it has been identified to have a vulnerability that allows for excessive resource allocation, potentially leading to denial of service or other resource exhaustion issues.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8885, arises from the allocation of resources without limits or throttling in the Bouncy Castle for Java library. This issue affects versions from BC 1.0 through 1.77, and from BC-FJA 1.0.0 through 2.0.0. The excessive allocation can lead to significant performance degradation and may allow attackers to exploit the library to exhaust system resources, resulting in service interruptions or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may limit the resource allocation in your application by implementing throttling mechanisms or resource limits in your application code. This can help mitigate the impact of the vulnerability until a proper update is applied.
Conclusion
The CVE-2025-8885 vulnerability in the Bouncy Castle library poses significant risks due to excessive resource allocation. It is crucial for users to update to the patched version to mitigate these risks and ensure the stability of their applications.
See every vulnerability recorded for bouncycastle →
FAQ
CVE-2025-8885 is a vulnerability in the Bouncy Castle library that allows for excessive resource allocation, potentially leading to denial of service.
The affected versions include Bouncy Castle from 1.0 to 1.77 and BC-FJA from 1.0.0 to 2.0.0.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The vulnerability can lead to performance issues, service interruptions, and potential crashes due to resource exhaustion.
Yes, a patch is available in version 1.80-1 and later of the Bouncy Castle package.
References
Related vulnerabilities
Recent vulnerabilities recorded for bouncycastle.
