CVE-2025-8916 MEDIUM

CVE-2025-8916: Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Vendor Legion Of The Bouncy Castle Inc.
Product BC Java
Weakness CWE-770 · Uncontrolled resource consumption
Published August 13, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

What the vulnerability does

01Description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Key dates

02Disclosure timeline

August 13, 2025 CVE published
May 12, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-29772 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands CVE-2024-5210 CVE-2022-4019 Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server CVE-2026-49754 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVE-2021-0285 Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic