CVE-2025-8916 Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer

What is CVE-2025-8916?

CVE-2025-8916 is a medium-severity denial of service vulnerability in Legion of the Bouncy Castle Inc. BC Java, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.

This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

Weakness: CWE-770

Which versions are affected by CVE-2025-8916?

10 open source packages ship an affected version, including org.bouncycastle:bcpkix-fips, org.bouncycastle:bcpkix-jdk15on and org.bouncycastle:bcpkix-jdk15to18.

How do I fix CVE-2025-8916?

Upgrade org.bouncycastle:bcpkix-fips to a fixed version for your release line: 1.0.8 or 2.0.8.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-8916 being exploited?

There is no known exploitation of CVE-2025-8916 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-LB17279, CLEANSTART-2026-VN09623, CLSA-2026-1770336550, CLSA-2026-1793133867, DEBIAN-CVE-2025-8916, ECHO-3e4c-cfff-062a and 21 more.