In Bouncy Castle for Java before version 1.85, the ASN.1 parser contains a flaw that allows a lazily constructed sequence to reset the internal nesting‑depth guard. This behavior represents a CWE‑674 vulnerability, as it permits uncontrolled recursion and resource consumption. When a deeply nested or malformed ASN.1 structure is parsed, the guard can be bypassed, leading to uncontrolled recursion. The resulting excessive memory or stack usage can cause the application to become unresponsive or crash, effectively denying service to legitimate users.

Affected products include Legion of the Bouncy Castle Inc.’s BC‑JAVA libraries for Java, the LTS releases prior to 2.73.12, and the Bouncy Castle for Java FIPS (BC‑FJA) before bc‑fips 1.0.2.7, 2.0.2 or 2.1.3.

The CVSS score of 8.7 marks this vulnerability as high severity. The EPSS score is 0.00263 and it is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. The likely attack vector is from any entity that can supply or influence ASN.1 data processed by the library, which could be remote (e.g., via network) or local depending on the application context. If untrusted data is parsed, a malformed ASN.1 structure could trigger the recursion loop, exhausting resources and bringing the system down.