N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9092

CVE-2025-9092: Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.

This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9092

CVE-2025-9092:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.bouncycastle:bc-fips	maven	= 2.1.0	2.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled resource consumption issue in the Bouncy Castle FIPS Java API (BC-FJA). The root cause is the behavior of the NativeLoader class, which is responsible for loading native libraries required for FIPS-certified cryptographic operations. In the vulnerable version (2.1.0), the loadLibrary method in this class would create a new temporary directory and extract the native library from the JAR file every time it was called. In an environment with multiple JVMs using the Bouncy Castle FIPS provider, this would lead to the creation of a large number of directories, each containing a copy of the native library. This behavior could exhaust disk space or inode limits on the server, leading to a denial of service.

The fix, introduced in version 2.1.1, modifies the loadLibrary method to prevent this excessive resource allocation. The patched version now checks for the existence of a pre-extracted library in a shared location. If the library is found and its checksum matches the one in the JAR, it is reused. Otherwise, the library is extracted once and a checksum file is created to be used for future checks. This ensures that the native library is extracted only once per version, regardless of how many times the loadLibrary method is called or how many JVMs are running.

The vulnerable function is org.bouncycastle.crypto.fips.NativeLoader.loadLibrary. A runtime profiler would show this function being called during the initialization of the Bouncy Castle FIPS provider. In a vulnerable environment, this function would be called frequently, and its execution would involve file system operations to create directories and write files, which would be the primary indicators of the vulnerability being triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.