CVE catalog

CVE-2025-12194

bouncycastle: CVE-2025-12194

Severity: Medium · CVSS 5.9CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:M/U:Amber
Published: Oct 24, 2025, 10:51:36 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 25, 2026

A unconstrained resource allocation flaw has been discovered in the bc-fips and bcprov-lts8on modules of the Bouncy Castle project. It appears under very high loads the scheduling of the disposal thread is such that it only gets called rarely, or at least not soon enough. The issue has been fixed by introducing the use of reachability-fencing. This available in Java 9 and later, so Java 8 is still using the disposal daemon as before has been changed to reduce friction (synchronized has been introduced where some friction is still required). A new property has also been added "org.bouncycastle.native.cleanup_priority" which can be set to "min", "normal", or "high" (default "min") in case disposal thread scheduling will be beneficial for Java 8 as well. bcprov-lts8on: bc-fips: Uncontrolled Resource Consumption vulnerability in Bouncy Castle The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bouncycastle	bookworm	Not reported	vulnerable
Debian	bouncycastle	bookworm	Not reported	vulnerable
Debian	bouncycastle	12	`1.72-2`	vulnerable
Debian	bouncycastle	12	`1.77-1`	vulnerable
Debian	bouncycastle	12	`1.80-1`	vulnerable
Debian	bouncycastle	12	`1.80-2`	vulnerable
Debian	bouncycastle	12	`1.80-3`	vulnerable
Debian	bouncycastle	13	`1.80-3`	vulnerable
Debian	bouncycastle	14	`1.80-3`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libbcjmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbcmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbcpg-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbcpkix-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbcprov-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbctls-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
[libbcutil-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12
- 1.72-2 · all · bookworm
  Affected
  dsa · bouncycastle · debian · bookworm; dsa · bouncycastle · debian · 12

[Debian 13 (Trixie)]

[libbcjmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbcmail-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbcpg-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbcpkix-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbcprov-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbctls-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
[libbcutil-java]Affected
Source package: [bouncycastle]
Details (2)
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13
- 1.80-3 · all · trixie
  Affected
  dsa · bouncycastle · debian · 13

Observed: Oct 24, 2026, 5:10:12 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]