An uncontrolled memory allocation vulnerability in Bouncy Castle products allows unauthenticated attackers to cause a denial of service via memory exhaustion.

The vulnerability involves memory allocation with an excessive size value (CWE-789), which an unauthenticated attacker can exploit to force the application to consume excessive memory, leading to an out-of-memory error.

The CVSS score of 8.7 highlights the severity of this issue. Successful exploitation will crash the host application, resulting in downtime and potentially impacting the integrity of ongoing memory-resident processes.

Immediate Action: Update all affected Bouncy Castle libraries to the specified patched versions to ensure proper validation of memory allocation requests.

Proactive Monitoring: Monitor JVM memory usage and garbage collection metrics for anomalous behavior, such as rapid memory growth or frequent OutOfMemoryError exceptions.

Compensating Controls: Enforce strict input size limits at the application boundary to prevent excessively large data payloads from reaching the library's parsing logic.

Public Exploit Available: false

Given the ease with which memory exhaustion can be triggered, this vulnerability should be treated as a high priority. Security teams should coordinate with developers to ensure the library is updated across all production environments.