CVE-2025-8885

Possible DOS in processing specially formed ASN.1 Object Identifiers

State: Published
Severity: 6.3 Medium
Published: Aug 12, 2025
Updated: Sep 12, 2025
Reserved: Aug 12, 2025

Description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .

This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber	bcorg

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
BC JavaLegion of the Bouncy Castle Inc.	1.0 through 1.77Affected
BC-FJALegion of the Bouncy Castle Inc.	1.0.0 through 1.0.2.5Affected 2.0.0 through 2.0.1Affected

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.