Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8108-1 advisory.

    It was discovered that Bouncy Castle did not sanitize user input when inserting it into an LDAP search     filter. An attacker could possibly use this issue to perform an LDAP injection attack. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-33201)

    It was discovered that Bouncy Castle incorrectly handled specially crafted F2m parameters in the ECCurve     algorithm. An attacker could possibly use this issue to cause Bouncy Castle to use excessive resources,     leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04     LTS, and Ubuntu 24.04 LTS. (CVE-2024-29857)

    It was discovered that Bouncy Castle leaked timing information when handling exceptions during an RSA     handshake. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-30171)

    It was discovered that Bouncy Castle incorrectly handled endpoint identification with an SSL socket     enabled without an explicit hostname. An attacker could possibly use this issue to perform a DNS poisoning     attack. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
    (CVE-2024-34447)

    Bing Shi discovered that Bouncy Castle incorrectly handled resource memory allocation. An attacker could     possibly use this issue to cause Bouncy Castle to use excessive resources, leading to a denial of service.
    This issue only affected Ubuntu 24.04 LTS. (CVE-2025-8916)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (jquery-cookie)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of     Siebel CRM Deployment accessible data. (CVE-2022-23395)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (Apache     Xerces-C++)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     high privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in takeover of Siebel CRM Integration. (CVE-2024-23807)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing     (Apache Commons FileUpload)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps -     Marketing. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. (CVE-2025-48976)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure     (Bouncy Castle Java Library)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Siebel CRM Deployment. (CVE-2025-8916)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST (Apache Commons     Lang)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Siebel CRM Integration. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC     Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules),     Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation.
    This vulnerability is associated with program files https://github.Com/bcgit/bc-     java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java,     https://github.Com/bcgit/bc-     java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC     Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from     2.0.0 through 2.0.7. (CVE-2025-8916)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303028	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Bouncy Castle vulnerabilities (USN-8108-1)	Nessus	Ubuntu Local Security Checks	medium
294868	Oracle Siebel Server <= 25.9 (January 2026 CPU)	Nessus	Misc.	medium
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
260006	Linux Distros Unpatched Vulnerability : CVE-2025-8916	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-8916

medium

Tenable Plugins

medium

medium

high

medium