An unauthenticated remote attacker can trigger a denial of service in Bouncy Castle for Java by providing crafted inputs that cause excessive memory allocation during processing.

The library suffers from CWE-789, which is a failure to properly validate size values during memory allocation. While the vulnerability requires user interaction, it remains accessible to unauthenticated remote attackers who can influence the data processed by the library.

This vulnerability carries a CVSS score of 7.1, reflecting a high risk of service disruption. By forcing excessive memory usage, an attacker can crash the application, leading to downtime for systems relying on Bouncy Castle for secure operations or internal cryptographic tasks.

Immediate Action: Update to Bouncy Castle versions 1.85 (for BC-JAVA) or 2.73.12 (for BC-LTS-JAVA) to resolve the memory allocation defect.

Proactive Monitoring: Review application performance metrics and error logs for patterns of memory-related exceptions or service restarts.

Compensating Controls: Deploy a Web Application Firewall or input validation filter to block malformed or excessively large cryptographic payloads before they reach the library.

Public Exploit Available: No (unknown)

Security teams should schedule the update of Bouncy Castle dependencies to the latest version to neutralize this denial of service risk. Prioritize systems where the library processes untrusted user-supplied data, as these are the most likely vectors for exploitation.