Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

中 6.3CVE-2025-8916 · GHSA-4cx2-fc23-5wg6 · 13/08/2025 公開 · 17/06/2026 更新

要点

CVE-2025-8916 は org.bouncycastle:bcpkix-fips, org.bouncycastle:bcpkix-jdk15on, org.bouncycastle:bcpkix-jdk15to18 に影響する深刻度「中」 (CVSS 6.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.46%（全脆弱性の 40.0% より高い）。
対処：1.0.8, 2.0.8, 1.79 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.bouncycastle:bcpkix-fips Maven	`≥ 1.0.0, < 1.0.8≥ 2.0.0, < 2.0.8`	`1.0.82.0.8`
org.bouncycastle:bcpkix-jdk15on Maven	`≥ 1.44, < 1.79`	`1.79`
org.bouncycastle:bcpkix-jdk15to18 Maven	`≥ 1.44, < 1.79`	`1.79`
org.bouncycastle:bcpkix-jdk18on Maven	`≥ 1.44, < 1.79`	`1.79`

概要

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.

NVD の説明

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.