Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java. This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java
    FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-
    lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program
    files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java,
    core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java. This issue affects Bouncy
    Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
    (CVE-2025-12194)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java     FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-     lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program     files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java,     core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java. This issue affects Bouncy     Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
    (CVE-2025-12194)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
435837	SCA: security update for org.bouncycastle:bc-fips, org.bouncycastle:bcprov-debug-lts8on (GHSA-jv6h-4262-q663)	Tenable Cloud Security	SCA Checks	medium
435837	SCA: security update for org.bouncycastle:bc-fips, org.bouncycastle:bcprov-debug-lts8on (GHSA-jv6h-4262-q663)	Tenable Self-Hosted Container Security	SCA Checks	medium
271707	Linux Distros Unpatched Vulnerability : CVE-2025-12194	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-12194

medium

Tenable Plugins

medium

medium

medium