CyberRota Analysis
AI-GeneratedThe OER parser in Bouncy Castle for Java versions prior to 1.85, as well as the LTS and FIPS versions before specified updates, is vulnerable to unbounded recursion when processing self-referential IEEE 1609.2 schemas. This flaw could lead to denial of service due to stack overflow, impacting applications that rely on these libraries for secure data processing. Organizations using affected versions of Bouncy Castle should prioritize updating to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Related CVEs
Other vulnerabilities affecting the same vendor(s)