CVE-2025-8885
Publication date 12 August 2025
Last updated 5 March 2026
Ubuntu priority
Description
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| bouncycastle | 25.10 questing |
Not affected
|
| 24.04 LTS noble | Ignored changes too intrusive | |
| 22.04 LTS jammy | Ignored changes too intrusive | |
| 20.04 LTS focal | Ignored changes too intrusive | |
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored changes too intrusive |
Notes
hlibk
On noble and below, an overhaul commit needs to be backported which changes the behavior of the application and may introduce regressions. Relevant commit: 058f85e194ca122c5768599467f57bcc1ce19597.