CVE-2025-8916: Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Medium severity · published Aug 13, 2025

CVE-2025-8916

Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

6.3

CVSS

0.5%

EPSS

On KEV

Description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 40% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BC Java · Legion of the Bouncy Castle Inc.

1.44 through 1.78; 1.44 through 1.78 · source: vendor

BCPKIX FIPS · Legion of the Bouncy Castle Inc.

1.0.0 through 1.0.7; 2.0.0 through 2.0.7 · source: vendor