Resource exhaustion in Bouncy Castle for Java - CVE-2025-8885

Vulnerability identifier: #VU121014

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-8885

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing ASN.1 OIDs. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Bouncy Castle for Java
DataPower Operations Dashboard
Rational Performance Tester
Integration Bus for z/OS
DevOps Test Performance
StreamSets Data Collector
MongoDB Enterprise Advanced with IBM
webMethods BPM
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Spectrum Symphony
IBM App Connect Enterprise
EntireX
Oracle GoldenGate Big Data and Application Adapters
Splunk AppDynamics Analytics Agent

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.78
DataPower Operations Dashboard - update to 1.0.23.3
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
IBM Sterling External Authentication Server - addressed in versions 6.1.0.4, 6.1.1.1
IBM Spectrum Symphony - update to 7.3.2 FP3
Integration Bus for z/OS - update to 10.1.0.6
DevOps Test Performance - update to 11.0.7
IBM App Connect Enterprise - addressed in versions 12.0.12.17, 13.0.5.0
StreamSets Data Collector - update to 6.4.0
MongoDB Enterprise Advanced with IBM - addressed in versions 7.0.22, 8.0.19
webMethods BPM - addressed in versions 10.15 Fix 25, 11.1 Fix 7
EntireX - update to 11.1.0.0009-0985
Splunk AppDynamics Analytics Agent - update to 26.1.0

• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885
• https://github.com/bcgit/bc-java/commit/3790993df5d28f661a64439a8664343437ed3865

• Multiple vulnerabilities in Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM StreamSets Data Collector
• IBM EntireX update for Bouncy Castle
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• IBM webMethods BPM update for Bouncy Castle
• MongoDB Enterprise Advanced with IBM update for Bouncy Castle
• Splunk AppDynamics Analytics Agent update for third-party components
• IBM DataPower Operations Dashboard update for Bouncy Castle