LOW

GHSA-v6cf-mv9h-c8mc

Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability

Quick fix

GHSA-v6cf-mv9h-c8mc — org.bouncycastle:bc-fips: upgrade to the fixed version with the command below.

# pom.xml: bump <version>2.1.1</version> for org.bouncycastle:bc-fips

Details

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.

This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.bouncycastle:bc-fips

Introduced in: 2.1.0Fixed in: 2.1.1

Fix# pom.xml: bump <version>2.1.1</version> for org.bouncycastle:bc-fips

References

https://nvd.nist.gov/vuln/detail/CVE-2025-9092[ADVISORY]
https://github.com/bcgit/bc-java[PACKAGE]
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909092[WEB]