Allocation of Resources Without Limits or Throttling in Bouncy Castle for Java - CVE-2025-8916

Vulnerability identifier: #VU117436

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-8916

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to improper resource allocation. A remote attacker can library to consume excessive resources and perform a denial of service attack. 

Bouncy Castle for Java
IBM Disconnected Log Collector
IBM App Connect for Manufacturing
DataPower Operations Dashboard
Storage Defender - Resiliency Service
DevOps
Maximo Application Suite - IoT Component
Maximo Application Suite - Predict Component
Rational Performance Tester
Integration Bus for z/OS
DevOps Test Performance
ApplinX
Cloudera Observability with IBM
StreamSets Data Collector
Guardium Data Protection
IBM Observability with Instana
Netcool Operations Insight
IBM Sterling Secure Proxy
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling External Authentication Server
IBM UrbanCode Release
IBM Spectrum Symphony
IBM Security Verify Governance
Oracle Middleware Common Libraries and Tools
Splunk AppDynamics Database Agent
Oracle Communications Cloud Native Core Certificate Management
IBM Cloud Object Storage Systems
watsonx.data
Oracle Utilities Application Framework
Oracle Global Lifecycle Management NextGen OUI Framework
Communications Unified Assurance
IBM License Metric Tool
IBM DB2
Oracle GoldenGate Big Data and Application Adapters
Oracle Essbase
IBM App Connect Enterprise
Oracle WebLogic Server
Ubuntu
Anolis OS
Siebel CRM Deployment
bouncycastle (Ubuntu package)
bouncycastle-javadoc
bouncycastle
bouncycastle-util
bouncycastle-tls
bouncycastle-pkix
bouncycastle-pg
bouncycastle-mail
bouncycastle-jmail

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.79
IBM Disconnected Log Collector - update to 2.0.0
DataPower Operations Dashboard - update to 1.0.23.3
IBM Observability with Instana - update to 1.0.307
Netcool Operations Insight - update to 1.6.15
Storage Defender - Resiliency Service - update to 2.0.18
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.2
IBM Sterling External Authentication Server - addressed in versions 6.1.0.4, 6.1.1.1
DevOps - update to 7.0.0.6
IBM Spectrum Symphony - update to 7.3.2 FP3
Maximo Application Suite - IoT Component - addressed in versions 8.7.29, 8.8.26, 9.0.15, 9.1.6
Maximo Application Suite - Predict Component - addressed in versions 8.8.12, 8.9.14, 9.0.11, 9.1.4
IBM License Metric Tool - update to 9.2.42
IBM Security Verify Governance - update to 10.0.2.0.7
Integration Bus for z/OS - update to 10.1.0.6
DevOps Test Performance - update to 11.0.7
IBM App Connect Enterprise - addressed in versions 12.0.12.17, 13.0.5.0
Splunk AppDynamics Database Agent - update to 26.1.0
bouncycastle (Ubuntu package) - addressed in versions 1.51-4ubuntu1+esm1, 1.59-1ubuntu0.1~esm1, 1.61-1ubuntu0.1~esm1, 1.68-5ubuntu0.1~esm1, 1.77-1ubuntu0.1~esm1
bouncycastle-javadoc - update to 1.79-1
bouncycastle - update to 1.79-1
bouncycastle-util - update to 1.79-1
bouncycastle-tls - update to 1.79-1
bouncycastle-pkix - update to 1.79-1
bouncycastle-pg - update to 1.79-1
bouncycastle-mail - update to 1.79-1
bouncycastle-jmail - update to 1.79-1
Cloudera Observability with IBM - update to 3.6.2
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
StreamSets Data Collector - update to 6.4.0
Guardium Data Protection - addressed in versions 12.0p55, 12.0p140, 12.2.1

• https://github.com/advisories/GHSA-4cx2-fc23-5wg6

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Certificate Management
• Multiple vulnerabilities in Oracle Essbase
• Anolis OS update for bouncycastle
• Improper input validation in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• IBM Watson Speech Services Cartridge update for Bouncy Castle
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM License Metric Tool
• IBM App Connect for Manufacturing update for Bouncy Castle
• IBM Maximo Application Suite - Predict Component update for bcpkix-jdk18on-1.78.1.jar
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM Spectrum Symphony
• IBM watsonx.data update for Bouncy Castle
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Siebel CRM Deployment
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• IBM Db2 Federated server update for bcprov-jdk18on and bcpkix-jdk18on
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM
• Splunk AppDynamics Database Agent update for third-party components
• IBM DataPower Operations Dashboard update for Bouncy Castle
• Multiple vulnerabilities in IBM DevOps Release
• Ubuntu update for bouncycastle
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• IBM Guardium Data Protection update for Bouncy Castle
• Denial of service in Bouncy Castle for Java
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in IBM ApplinX