Medium severity · published Aug 12, 2025
CVE-2025-8885
Possible DOS in processing specially formed ASN.1 Object Identifiers
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .
This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BJ
BC Java · Legion of the Bouncy Castle Inc.
1.0 through 1.77 · source: vendor
BC
BC-FJA · Legion of the Bouncy Castle Inc.
1.0.0 through 1.0.2.5; 2.0.0 through 2.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8885
github.com
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885
More from BC Java
9.2
CVE-2026-71885
MLS X.509 credential not bound to the LeafNode signature key
9.1
CVE-2026-58062
Stapled OCSP response accepted without binding to the checked certificate
9.1
CVE-2026-59650
MTI/A0 DH agreement exponentiates unvalidated peer value
9.1
CVE-2026-8763
Name Constraints bypass via trailing dot in rfc822Name and URI
8.7
CVE-2026-71890
MLS external commit can remove an arbitrary group member