CVE-2025-9092 Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion
Attackers can cause resource exhaustion in applications using Bouncy Castle FIPS Java API, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-9092?
CVE-2025-9092 is a low-severity denial of service vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0, published on 16 Aug 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.
This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.
Weakness: CWE-400
Which versions are affected by CVE-2025-9092?
2 open source packages ship an affected version, including org.bouncycastle:bc-fips.
| Package | Affected | Fixed in |
|---|---|---|
org.bouncycastle:bc-fips Maven | From 2.1.0 | 2.1.1 |
org.bouncycastle:bc-fips Maven | From 2.1.0 | 2.1.1 |
How do I fix CVE-2025-9092?
Upgrade org.bouncycastle:bc-fips to 2.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-9092 being exploited?
There is no known exploitation of CVE-2025-9092 in the wild and no public exploit code.
Sources
Also known as GHSA-v6cf-mv9h-c8mc.