Bouncy Castle for Java Excessive Resource Allocation Vulnerability

A vulnerability allowing excessive resource allocation has been identified in Legion of the Bouncy Castle Inc. Bouncy Castle for Java, specifically in the bcpkix and bcprov libraries, as well as BCPKIX FIPS modules. This issue affects versions BC 1.44 prior to 1.78, BCPKIX FIPS 1.0.0 through 1.0.7, and BCPKIX FIPS 2.0.0 through 2.0.7. The vulnerability arises from the PKIXCertPathReviewer class, which lacks a defined limit on the size of name constraints objects. As a result, applications using this class could be susceptible to denial-of-service attacks by processing large, unvalidated certificate paths.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition by causing applications to hang or crash while processing large name constraint structures.

Remediation

Users can upgrade to Bouncy Castle for Java version 1.79, BCPKIX FIPS 1.0.8, or BCPKIX FIPS 2.0.8 to address this vulnerability.