CVE-2025-12194
NoneCVSS
—
EPSS
0.2%
Published
Oct 24, 2025
CISA due date
—
The record
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java. This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.bouncycastle:bc-fips | 2.1.0 | 2.1.2 |
| Maven | org.bouncycastle:bcprov-debug-lts8on | 2.73.0 | 2.73.8 |
| Chainguard | guacamole-client-extensions | 0 | 1.6.0-r1 |
| Chainguard | guacamole-client-extensions | 0 | 1.6.0-r2 |
| Chainguard | opensearch-3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-alerting | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-icu | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-kuromoji | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-nori | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-phonetic | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-smartcn | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-stempel | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-ukrainian | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-anomaly-detection | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-asynchronous-search | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-cross-cluster-replication | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-crypto-kms | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-custom-codecs | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-azure-classic | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-ec2 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-gce | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-geospatial | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-identity-shiro | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-index-management | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-ingest-attachment | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-job-scheduler | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-k-nn | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-annotated-text | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-murmur3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-size | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-ml-commons | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-neural-search | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-notifications | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-observability | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-performance-analyzer | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-reporting | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-azure | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-gcs | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-s3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-security | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-security-analytics | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-sql | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-store-smb | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-telemetry-otel | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-alerting | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-icu | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-kuromoji | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-nori | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-phonetic | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-smartcn | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-stempel | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-ukrainian | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-anomaly-detection | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-asynchronous-search | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-cross-cluster-replication | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-crypto-kms | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-custom-codecs | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-azure-classic | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-ec2 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-gce | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-geospatial | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-identity-shiro | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-index-management | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-ingest-attachment | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-job-scheduler | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-k-nn | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-annotated-text | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-murmur3 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-size | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-ml-commons | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-neural-search | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-notifications | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-observability | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-performance-analyzer | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-reporting | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-repository-azure | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-repository-gcs | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-repository-s3 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-security | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-security-analytics | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-sql | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-store-smb | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-telemetry-otel | 0 | 3.3.2-r0 |
| maven | org.bouncycastle/bc-fips | 2.1.0 | 2.1.2 |
| maven | org.bouncycastle/bcprov-debug-lts8on | 2.73.0 | 2.73.8 |
Related vulnerabilities
- CVE-2025-8885 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects org.bouncycastle:bc-fips
- CVE-2024-29857 An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)… Also affects org.bouncycastle:bc-fips
- CVE-2022-45146 An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Also affects org.bouncycastle:bc-fips
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects opensearch-3
- CVE-2025-54988 Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and… Also affects opensearch-3
- CVE-2025-8916 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects opensearch-3
- CVE-2025-55163 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Also affects opensearch-3
- CVE-2025-22227 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks… Also affects opensearch-3