CVE-2025-8885

Name	CVE-2025-8885
Description	Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bouncycastle (PTS)	bullseye	1.68-2	vulnerable
	bookworm	1.72-2	vulnerable
	forky, sid, trixie	1.80-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
bouncycastle	source	(unstable)	1.80-1

Notes

[bookworm] - bouncycastle <no-dsa> (Minor issue)
[bullseye] - bouncycastle <postponed> (minor vulnerability; DoS)
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885
Fixed by: https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865 (r1rv78v1)