An uncontrolled recursion flaw in various Bouncy Castle libraries allows unauthenticated remote attackers to cause a denial of service through application crashes.

This vulnerability is identified as CWE-674: Uncontrolled Recursion. An unauthenticated attacker can exploit this flaw by providing specially crafted input that triggers deep recursion, resulting in stack exhaustion and an application crash.

The inability to process requests due to stack exhaustion leads directly to a denial of service, impacting system availability and uptime. Given the core nature of these libraries, this can have cascading effects on all services that depend on them for data processing or security functions. The 8.7 CVSS score justifies the need for immediate remediation to prevent service outages.

Immediate Action: Update all affected Bouncy Castle components to the latest versions (BC-JAVA 1.85, BC-LTS-JAVA 2.73.12, or the corresponding fixed BC-FJA versions) as specified by the vendor.

Proactive Monitoring: Monitor system logs for stack overflow errors or repeated application restart events that may indicate active exploitation attempts.

Compensating Controls: Use Web Application Firewalls to inspect incoming traffic for patterns that may attempt to trigger deep recursion in cryptographic parsers.

Public Exploit Available: No

Due to the critical nature of the affected libraries, organizations should conduct an audit of their software supply chain to identify instances of the vulnerable packages. Applying the vendor-supplied updates is the only definitive way to mitigate the risk of denial of service attacks.