CVE-2025-8885: Bouncy Castle for Java on All (API modules) allows Excessive Allocation
N/A
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bouncycastle:bcprov-jdk14 | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk15to18 | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk18on | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk14 | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk15to18 | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk18on | maven | >= 1.0, < 1.78 | 1.78 |
| org.bouncycastle:bc-fips | maven | >= 1.0.0, <= 2.0.0 | 2.1.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is an excessive allocation issue within the Bouncy Castle library's ASN.1 parsing logic. The core of the problem lies in the ASN1ObjectIdentifier and ASN1RelativeOID classes, which lacked validation for the size of the OID data they were processing. The patch addresses this by introducing a size limit (MAX_CONTENTS_LENGTH) and adding checks in the constructors and methods (branch) that create or extend OIDs. The changes in ASN1InputStream show that the vulnerability could be triggered by parsing a malicious ASN.1 stream, making it a critical pathway for exploitation. The identified functions are the exact locations where the unbounded allocation could occur and are the functions that were modified to enforce the new size limits, making them the vulnerable functions.