CVE-2025-12194

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java. This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.

• CWE-400

• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9012194

Published

Oct 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12189The Bread & Butter: Gate content + Capture leads + Collect f…8.8
• CVE-2025-1219In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f…5.3
• CVE-2025-12190The Image Optimizer by wps.sk plugin for WordPress is vulner…4.3
• CVE-2025-12191The PDF Catalog for WooCommerce plugin for WordPress is vuln…5.4
• CVE-2025-12192The Events Calendar plugin for WordPress is vulnerable to in…5.3
• CVE-2025-12193The Mang Board WP plugin for WordPress is vulnerable to Refl…6.1
• CVE-2025-12195An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
• CVE-2025-12196An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
• CVE-2025-12197The The Events Calendar plugin for WordPress is vulnerable t…7.5
• CVE-2025-12198Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-12199Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-1220In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.…5.3