CVE-2025-8885 Possible DOS in processing specially formed ASN.1 Object Identifiers
Attackers can cause denial of service in Bouncy Castle Java libraries by sending specially formed ASN.1 Object Identifiers that trigger excessive resource allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-8885?
CVE-2025-8885 is a medium-severity denial of service vulnerability in Legion of the Bouncy Castle Inc. BC Java, published on 12 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java .
This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Weakness: CWE-770
Which versions are affected by CVE-2025-8885?
16 open source packages ship an affected version, including org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15to18.
| Package | Affected | Fixed in |
|---|---|---|
org.bouncycastle:bc-fips Maven | From 1.0.0 | 1.0.2.6 |
org.bouncycastle:bc-fips Maven | From 1.0.0 | 1.0.2.6 |
org.bouncycastle:bc-fips Maven | From 2.0.0 | 2.0.1 |
org.bouncycastle:bc-fips Maven | From 2.0.0 | 2.0.1 |
org.bouncycastle:bcprov-jdk14 Maven | From 1.0 | 1.78 |
org.bouncycastle:bcprov-jdk14 Maven | From 1.0 | 1.78 |
10 more packages
org.bouncycastle:bcprov-jdk15to18 Maven | From 1.0 | 1.78 |
org.bouncycastle:bcprov-jdk15to18 Maven | From 1.0 | 1.78 |
org.bouncycastle:bcprov-jdk18on Maven | From 1.0 | 1.78 |
org.bouncycastle:bcprov-jdk18on Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk14 Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk14 Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk15to18 Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk15to18 Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk18on Maven | From 1.0 | 1.78 |
org.bouncycastle:bctls-jdk18on Maven | From 1.0 | 1.78 |
How do I fix CVE-2025-8885?
Upgrade org.bouncycastle:bc-fips to a fixed version for your release line: 1.0.2.6 or 2.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-8885 being exploited?
There is no known exploitation of CVE-2025-8885 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-NG21036, CLEANSTART-2026-QI64400, DEBIAN-CVE-2025-8885, ECHO-38fb-159d-e253, GHSA-67mf-3cr5-8w23, MINI-355v-9f3r-h9r4 and 10 more.