A high-severity infinite loop vulnerability in the Bouncy Castle for Java FIPS library can be leveraged by remote attackers to crash dependent services.

The flaw is categorized as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop. It allows unauthenticated remote attackers to trigger the condition, causing the application to hang or consume excessive CPU cycles.

The exploitation of this vulnerability leads to immediate service disruption and potential system-wide performance degradation. With a CVSS score of 8.7, this issue is critical for environments where high availability is required, as the lack of authentication requirements makes it easy for external actors to disrupt operations.

Immediate Action: Update the Bouncy Castle for Java FIPS library to version 2.1.3 or later.

Proactive Monitoring: Review CPU utilization metrics and application thread dumps to identify processes stuck in infinite loops.

Compensating Controls: Deploy Web Application Firewalls or intrusion detection systems configured to identify and block malformed packets that might trigger this specific logic flaw.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate patching. Security teams should identify all applications utilizing the affected BC-FJA version and schedule an urgent update to version 2.1.3 to mitigate the risk of denial of service.