Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-9341

Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
bcorg

Description

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java, org/bouncycastle/crypto/engines/AESNativeCBC.Java. This issue affects Bouncy Castle for Java FIPS: 2.1.0; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS

Default version status: unaffected

  • 2.1.0affected

Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS

Default version status: unaffected

  • 2.73.0 to ≤ 2.73.7affected

References