A high-severity resource exhaustion vulnerability in the Bouncy Castle for Java FIPS library poses a significant risk of service disruption for dependent applications.

The vulnerability is identified as a CWE-772 (Missing Release of Resource after Effective Lifetime). It is triggered by unauthenticated attackers who can cause resource depletion, leading to application instability or failure.

Successful exploitation of this flaw can result in significant system downtime and service unavailability. Given the CVSS score of 8.7, the risk to operational continuity is high, as the vulnerability is network-exploitable without requiring authentication, potentially impacting any service relying on the library for cryptographic operations.

Immediate Action: Upgrade to versions 1.0.2.7, 2.0.2, 2.1.3, or later as specified by the vendor's security advisory.

Proactive Monitoring: Monitor server memory and thread usage patterns for sudden spikes or exhaustion trends that may indicate a resource leak attack.

Compensating Controls: Implement rate limiting or request throttling at the application or network perimeter to mitigate the impact of rapid resource consumption attempts.

Public Exploit Available: Unknown.

This vulnerability presents a critical threat to availability. Organizations using the BC-FJA library must prioritize updating to the specified patched versions to ensure system stability and prevent potential denial of service attacks.