Vulnerability-Lookup

ubuntu-cve-2025-8885

Vulnerability from osv_ubuntu

Published

2025-08-12 10:15

Modified

2026-03-19 05:18

Summary

Details

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.

Severity

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-8885	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-8885	REPORT
	https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libbcmail-java",
            "binary_version": "1.51-4ubuntu1+esm1"
          },
          {
            "binary_name": "libbcpg-java",
            "binary_version": "1.51-4ubuntu1+esm1"
          },
          {
            "binary_name": "libbcpkix-java",
            "binary_version": "1.51-4ubuntu1+esm1"
          },
          {
            "binary_name": "libbcprov-java",
            "binary_version": "1.51-4ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "bouncycastle",
        "purl": "pkg:deb/ubuntu/bouncycastle@1.51-4ubuntu1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.49+dfsg-3ubuntu1",
        "1.51-4ubuntu1",
        "1.51-4ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libbcmail-java",
            "binary_version": "1.59-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcpg-java",
            "binary_version": "1.59-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcpkix-java",
            "binary_version": "1.59-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcprov-java",
            "binary_version": "1.59-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "bouncycastle",
        "purl": "pkg:deb/ubuntu/bouncycastle@1.59-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.57-1",
        "1.58-1",
        "1.59-1",
        "1.59-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libbcmail-java",
            "binary_version": "1.61-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcpg-java",
            "binary_version": "1.61-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcpkix-java",
            "binary_version": "1.61-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libbcprov-java",
            "binary_version": "1.61-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "bouncycastle",
        "purl": "pkg:deb/ubuntu/bouncycastle@1.61-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.61-1",
        "1.61-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libbcmail-java",
            "binary_version": "1.68-5"
          },
          {
            "binary_name": "libbcpg-java",
            "binary_version": "1.68-5"
          },
          {
            "binary_name": "libbcpkix-java",
            "binary_version": "1.68-5"
          },
          {
            "binary_name": "libbcprov-java",
            "binary_version": "1.68-5"
          },
          {
            "binary_name": "libbctls-java",
            "binary_version": "1.68-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "bouncycastle",
        "purl": "pkg:deb/ubuntu/bouncycastle@1.68-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.68-2",
        "1.68-4",
        "1.68-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libbcjmail-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbcmail-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbcpg-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbcpkix-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbcprov-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbctls-java",
            "binary_version": "1.77-1"
          },
          {
            "binary_name": "libbcutil-java",
            "binary_version": "1.77-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "bouncycastle",
        "purl": "pkg:deb/ubuntu/bouncycastle@1.77-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.72-2",
        "1.77-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.",
  "id": "UBUNTU-CVE-2025-8885",
  "modified": "2026-03-19T05:18:21Z",
  "published": "2025-08-12T10:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8885"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8885"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-8885"
  ]
}

CVE-2025-8885 (GCVE-0-2025-8885)

Vulnerability from cvelistv5 – Published: 2025-08-12 09:13 – Updated: 2025-09-12 11:09

Title

Possible DOS in processing specially formed ASN.1 Object Identifiers

Summary

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

bcorg

References

1 reference

URL	Tags
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…

Impacted products

2 products

Vendor	Product	Version
Legion of the Bouncy Castle Inc.	BC Java	Affected: 1.0 , ≤ 1.77 (maven)
Legion of the Bouncy Castle Inc.	BC-FJA	Affected: 1.0.0 , ≤ 1.0.2.5 (maven) Affected: 2.0.0 , ≤ 2.0.1 (maven)

Credits

Bing Shi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T18:14:28.953244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T18:14:43.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/org/bouncycastle",
          "defaultStatus": "unaffected",
          "modules": [
            "API"
          ],
          "packageName": "bcprov",
          "platforms": [
            "All"
          ],
          "product": "BC Java",
          "programFiles": [
            "https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java"
          ],
          "repo": "https://github.com/bcgit/bc-java",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.77",
              "status": "affected",
              "version": "1.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo1.maven.org/maven2/org/bouncycastle",
          "defaultStatus": "unaffected",
          "modules": [
            "API"
          ],
          "packageName": "bc-fips",
          "platforms": [
            "All"
          ],
          "product": "BC-FJA",
          "vendor": "Legion of the Bouncy Castle Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.0.2.5",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "2.0.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To be exposed to the issue a system needs to be consuming ASN.1 structures which are otherwise unvetted or unvalidated."
            }
          ],
          "value": "To be exposed to the issue a system needs to be consuming ASN.1 structures which are otherwise unvetted or unvalidated."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bing Shi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java\"\u003ehttps://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti...\u003c/a\u003e\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files  https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .\n\nThis issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "USER",
            "Safety": "PRESENT",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/S:P/R:U/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-12T11:09:08.850Z",
        "orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
        "shortName": "bcorg"
      },
      "references": [
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Possible DOS in processing specially formed ASN.1 Object Identifiers",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Limiting the size of ASN.1 objects that can be loaded from \"the wild\", or putting in place some other validation for such objects, will mitigate the risk of an exploit by automatically putting a cap on the maximum size of an ASN.1 OBJECT IDENTIFIER.\u0026nbsp;"
            }
          ],
          "value": "Limiting the size of ASN.1 objects that can be loaded from \"the wild\", or putting in place some other validation for such objects, will mitigate the risk of an exploit by automatically putting a cap on the maximum size of an ASN.1 OBJECT IDENTIFIER."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
    "assignerShortName": "bcorg",
    "cveId": "CVE-2025-8885",
    "datePublished": "2025-08-12T09:13:42.770Z",
    "dateReserved": "2025-08-12T08:07:48.262Z",
    "dateUpdated": "2025-09-12T11:09:08.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2025-8885

Vulnerability from osv_ubuntu

CVE-2025-8885 (GCVE-0-2025-8885)

Tags

Sightings

Nomenclature