Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Timeline

1. Aug 13, 2025, 9:31 AM UTCCVE published
2. Aug 13, 2025, 1:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. May 12, 2026, 12:02 PM UTCRecord last updated

Affected versions

• bcpkix

  From 1.44 · through 1.78

• bcprov

  From 1.44 · through 1.78

• bcpkix-fips

  From 1.0.0 · through 1.0.7; From 2.0.0 · through 2.0.7

• org.bouncycastle:bcpkix-jdk15onMaven

  From 1.44 · fixed in 1.79

• org.bouncycastle:bcpkix-jdk15to18Maven

  From 1.44 · fixed in 1.79

• org.bouncycastle:bcpkix-jdk18onMaven

  From 1.44 · fixed in 1.79

• org.bouncycastle:bcpkix-fipsMaven

  From 1.0.0 · fixed in 1.0.8

• org.bouncycastle:bcpkix-fipsMaven

  From 2.0.0 · fixed in 2.0.8

References 1