Skip to content
Fencer Vulns
low 1.0

CVE-2025-9092 json

Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion

published 2025-08-16 14 mo ago modified 2026-09-10 1 mo ago also GHSA-v6cf-mv9h-c8mc , EUVD-2025-28810

cvss
1.0
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.

This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.

Patch / fix

  • maven org.bouncycastle:bc-fips 2.1.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9092 updated cvss 1.8

org.bouncycastle: Bouncycastle Resource Exhaustion

  • Red Hat Cryostat 4 bcpkix-jdk18on, bcprov-jdk18on, bcutil-jdk18on Red Hat Logging Subsystem for Red Hat OpenShift bcpg-jdk15on, bcmail-jdk15on, bcpkix-jdk15on, bcprov-jdk15on Red Hat AMQ Broker 7 bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, bcutil-jdk15on, bcutil-jdk18on Red Hat AMQ Clients bcpg-jdk18on, bctls-jdk15on, bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, +2 more Red Hat build of Apache Camel 4 for Quarkus 3 bcpg-jdk18on, bcpkix-jdk18on, bcprov-jdk18on, bcutil-jdk18on Red Hat build of Apache Camel for Spring Boot 4 bcpg-jdk18on, bcmail-jdk18on, bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, +3 more
    +18 more products
    Red Hat build of Apicurio Registry 3 bcpkix-jdk18on, bcprov-jdk18on, bcutil-jdk18on Red Hat build of Debezium 2 bcpkix-jdk15on, bcprov-jdk15on, bcutil-jdk15on, bcprov-ext-jdk15on Red Hat build of Debezium 3 bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, bcutil-jdk15on, bcutil-jdk18on, +1 more Red Hat build of Quarkus bcpg-jdk18on, bcpkix-jdk18on, bcprov-jdk18on, bcutil-jdk18on Red Hat Data Grid 8 bcpg-jdk15on, bcpg-jdk18on, bctls-jdk15on, bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, +6 more Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 jmc, resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Fuse 7 bcpg-jdk15on, bcpg-jdk18on, bcprov-jdk16, bctls-jdk18on, bcmail-jdk15on, bcmail-jdk18on, +12 more Red Hat JBoss Enterprise Application Platform 7 bcmail-jdk15, bcpg-jdk15on, bcpg-jdk18on, bcprov-jdk15, bctls-jdk15on, bctls-jdk18on, +8 more Red Hat JBoss Enterprise Application Platform 8 bc-fips, bctls-fips, bcpkix-fips, bcmail-jdk15, bcpg-jdk15on, bcpg-jdk18on, +17 more Red Hat JBoss Enterprise Application Platform Expansion Pack bc-fips, bctls-fips, bcpkix-fips, bcmail-jdk15, bcpg-jdk15on, bcpg-jdk18on, +17 more Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-modelmesh-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/pluginregistry-rhel9, devspaces-tech-preview/idea-rhel9 Red Hat Process Automation 7 bcpg-jdk15on, bcmail-jdk15on, bcpkix-jdk15on, bcprov-jdk15on, bcpkix-jdk15to18, bcprov-jdk15to18, +1 more Red Hat Satellite 6 candlepin, candlepin-selinux Red Hat Single Sign-On 7 bcpg-jdk15on, bcmail-jdk15on, bcpkix-jdk15on, bcprov-jdk15on Red Hat streams for Apache Kafka 2 bcpg-jdk18on, bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, bcutil-jdk15on, +1 more Red Hat streams for Apache Kafka 3 bcpg-jdk18on, bcpkix-jdk15on, bcpkix-jdk18on, bcprov-jdk15on, bcprov-jdk18on, bcutil-jdk15on, +1 more
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 1.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/R:U/RE:L/U:Green
CNA 4.0 1.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green

Affected packages

ecosystem package affected fixed in
maven org.bouncycastle:bc-fips
>=2.1.0, <2.1.1
2.1.1

Affected products

  • Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.