Bug 2406287 (CVE-2025-12194)

Summary: CVE-2025-12194 bcprov-lts8on: bc-fips: Uncontrolled Resource Consumption vulnerability in Bouncy Castle
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asoldano, bbaranow, bmaxwell, brian.stansberry, ccranfor, darran.lofthouse, dosoudil, eric.wittmann, istudens, ivassile, iweiss, janstey, jpechane, mosmerov, msvehla, nipatil, nwallace, pantinor, pesilva, pjindal, pmackay, rkubis, rstancel, smaestri, tom.jenkinson
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A unconstrained resource allocation flaw has been discovered in the bc-fips and bcprov-lts8on modules of the Bouncy Castle project. It appears under very high loads the scheduling of the disposal thread is such that it only gets called rarely, or at least not soon enough. The issue has been fixed by introducing the use of reachability-fencing. This available in Java 9 and later, so Java 8 is still using the disposal daemon as before has been changed to reduce friction (synchronized has been introduced where some friction is still required). A new property has also been added "org.bouncycastle.native.cleanup_priority" which can be set to "min", "normal", or "high" (default "min") in case disposal thread scheduling will be beneficial for Java 8 as well.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-24 23:01:48 UTC 
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.java.

This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 3.73.7.