{"id":"CVE-2025-8885","aliases":["GHSA-67mf-3cr5-8w23"],"url":"https://o3.security/vulnerability/CVE-2025-8885","summary":"Possible DOS in processing specially formed ASN.1 Object Identifiers","details":"Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files  https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .\n\nThis issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.","published":"2025-08-12T09:13:42.770Z","modified":"2026-08-07T11:31:31.933658292Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk14","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk15to18","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk18on","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bc-fips","fixedVersion":"1.0.2.6"},{"ecosystem":"Maven","name":"org.bouncycastle:bc-fips","fixedVersion":"2.0.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885"},{"type":"WEB","url":"https://repo1.maven.org/maven2/org/bouncycastle"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8885.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8885"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:31:31.933658292Z"}}