5.5

CVE-2023-33202: bouncycastle bouncy_castle_for_java Uncontrolled Resource Consumption

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2023-33202DEBIAN-CVE-2023-33202CGA-5wjv-m794-wp7w
Published 23-11-2023Last modified 18-08-2025
Open JSON

Vulnerability summary

CVE-2023-33202 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in bouncycastle bouncy_castle_for_java. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
1.02%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-HQ55-QP37-GWM6CGA-XFJM-M8MX-2QP9

Timeline

  1. 23-11-2023
    PublishedVulnerability first disclosed.
  2. 18-08-2025
    Last modifiedVulnerability information updated.

Description

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

+0.09 pp

From 0.93% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Bc Java

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard126 products
  • eco-java-gradle-1.11All versions (No fix recorded)
  • eco-java-gradle-2.0All versions (No fix recorded)
  • eco-java-gradle-2.1All versions (No fix recorded)
  • eco-java-gradle-2.10All versions (No fix recorded)
  • eco-java-gradle-2.11All versions (No fix recorded)
Org.bouncycastle9 products
  • bcpkix-jdk18on< 1.73
  • bcprov-ext-jdk15on< 1.73
  • bcprov-ext-jdk16< 1.73
  • bcprov-jdk14< 1.73
  • bcprov-jdk15< 1.73
Bouncycastle2 products
Wolfi2 products
  • gradle-8< 8.7.0-r1
  • gradle-stage0All versions (No fix recorded)
Debian1 product
  • bouncycastleAll versions (No fix recorded) | < 1.77-1
Ubuntu1 product
  • bouncycastleAll versions (No fix recorded)

6 vendors · 141 products

References

11 links
Show all 11 references