An uncontrolled recursion vulnerability in multiple Bouncy Castle products allows unauthenticated attackers to crash applications through stack exhaustion.

The vulnerability is an uncontrolled recursion flaw (CWE-674) that allows an unauthenticated attacker to trigger stack exhaustion, leading to a crash of the affected application.

With a CVSS score of 8.7, this vulnerability poses a significant risk to system availability. Applications relying on these libraries for secure communication or data processing may be rendered unavailable, leading to service outages and potential data loss if the system fails during a critical transaction.

Immediate Action: Update all affected Bouncy Castle components (BC-JAVA, BC-LTS-JAVA, and BC-FJA) to their respective patched versions as defined in the vendor advisory.

Proactive Monitoring: Monitor system logs for stack overflow errors or unexpected application terminations that could indicate an active exploit attempt.

Compensating Controls: Deploy a Web Application Firewall or input validation layer to block malformed inputs that might trigger deep recursion in the library.

Public Exploit Available: false

This vulnerability requires immediate attention due to its potential to cause widespread system instability. Organizations must identify all instances of the affected libraries within their software stack and apply the vendor-provided updates to restore stability.