Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).
This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | May 19, 2026 | Apr 15, 2026 |
| Redhat_linux | — | Upgrade eap8-bouncycastle-utilUpgrade eap8-netty-bufferUpgrade eap8-netty-resolver-dnsUpgrade eap8-netty-transport-native-epoll-debuginfoUpgrade eap8-xml-securityUpgrade eap8-activemq-artemis-hornetq-protocolUpgrade eap8-ironjacamar-jdbcUpgrade eap8-relaxng-datatypeUpgrade eap8-netty-commonUpgrade eap8-jackson-coreUpgrade eap8-jboss-remotingUpgrade eap8-ironjacamar-core-apiUpgrade eap8-activemq-artemis-core-clientUpgrade eap8-netty-handlerUpgrade eap8-txw2Upgrade eap8-eap-product-conf-wildfly-ee-feature-packUpgrade eap8-activemq-artemisUpgrade eap8-jsf-implUpgrade eap8-slf4jUpgrade eap8-activemq-artemis-serverUpgrade eap8-netty-resolverUpgrade eap8-hibernate-enversUpgrade eap8-ironjacamar-common-implUpgrade eap8-activemq-artemis-commonsUpgrade eap8-log4jUpgrade eap8-hibernateUpgrade eap8-ironjacamar-deployers-commonUpgrade eap8-jakarta-xml-bind-apiUpgrade eap8-jackson-dataformat-yamlUpgrade eap8-jbossws-cxfUpgrade eap8-activemq-artemis-jdbc-storeUpgrade eap8-httpcomponents-asyncclientUpgrade eap8-netty-handler-proxyUpgrade eap8-netty-transport-native-epollNo solution existsUpgrade eap8-jackson-jaxrs-baseUpgrade eap8-xsomUpgrade eap8-netty-codec-dnsUpgrade eap8-activemq-artemis-jakarta-serverUpgrade eap8-jaxb-xjcUpgrade eap8-jaxb-runtimeUpgrade eap8-ironjacamarUpgrade eap8-wildfly-java-jdk21Upgrade eap8-netty-transport-native-unix-commonUpgrade eap8-activemq-artemis-cliUpgrade eap8-nettyUpgrade eap8-hibernate-coreUpgrade eap8-jaxb-coreUpgrade eap8-jbossws-spiUpgrade eap8-bouncycastle-provUpgrade eap8-jackson-modules-baseUpgrade eap8-jaxbintrosUpgrade eap8-apache-cxfUpgrade eap8-wildfly-modulesUpgrade eap8-wildfly-javadocsUpgrade eap8-wildfly-elytronUpgrade eap8-rngomUpgrade eap8-codemodelUpgrade eap8-bouncycastle-pkixUpgrade eap8-jbossws-jaxws-undertow-httpspiUpgrade eap8-apache-cxf-toolsUpgrade eap8-netty-codec-socksUpgrade eap8-activemq-artemis-journalUpgrade eap8-bouncycastle-jmailUpgrade eap8-jbossws-common-toolsUpgrade eap8-ironjacamar-core-implUpgrade eap8-jackson-databindUpgrade eap8-jackson-modules-java8Upgrade eap8-jackson-datatype-jsr310Upgrade eap8-jackson-dataformats-textUpgrade eap8-apache-cxf-servicesUpgrade eap8-activemq-artemis-jakarta-service-extensionsUpgrade eap8-netty-codec-httpUpgrade eap8-bouncycastleUpgrade eap8-apache-cxf-rtUpgrade eap8-activemq-artemis-jakarta-clientUpgrade eap8-activemq-artemis-jakarta-raUpgrade eap8-wildfly-elytron-toolUpgrade eap8-netty-transport-classes-epollUpgrade eap8-artemis-wildfly-integrationUpgrade eap8-jaxbUpgrade eap8-jackson-datatype-jdk8Upgrade eap8-eap-product-conf-parentUpgrade eap8-activemq-artemis-selectorUpgrade eap8-saaj-implUpgrade eap8-parssonUpgrade eap8-netty-transportUpgrade eap8-neethiUpgrade eap8-jaxb-jxcUpgrade eap8-slf4j-apiUpgrade eap8-ironjacamar-common-spiUpgrade eap8-wildflyUpgrade eap8-ironjacamar-common-apiUpgrade eap8-jbossws-apiUpgrade eap8-undertowUpgrade eap8-nimbus-jose-jwtUpgrade eap8-activemq-artemis-dtoUpgrade eap8-jboss-loggingUpgrade eap8-netty-codecUpgrade eap8-cryptacularUpgrade eap8-bouncycastle-pgUpgrade eap8-ironjacamar-validatorUpgrade eap8-jackson-annotationsUpgrade eap8-jackson-jaxrs-json-providerUpgrade eap8-activemq-artemis-hqclient-protocolUpgrade eap8-ws-commons-XmlSchemaUpgrade eap8-jackson-module-jakarta-xmlbind-annotations | Jul 17, 2026 | Apr 15, 2026 |
| Suse | — | Upgrade bouncycastle-mailUpgrade bouncycastle-pkixUpgrade bouncycastle-javadocUpgrade bouncycastle-utilUpgrade bouncycastle-pgUpgrade bouncycastle-tlsUpgrade bouncycastleUpgrade bouncycastle-jmail | Apr 29, 2026 | Apr 29, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub