In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Sep 16, 2026 | Sep 15, 2026 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 11 installer 11.89.302 (JDK 11.0.31.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.51.302 (JDK 21.0.11.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.35.302 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.95.0.302 (JDK 8u503-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.67.302 (JDK 17.0.19.0.201+1, quarterly CPU) (LTS stream) | Sep 16, 2026 | Aug 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub