An algorithmic complexity flaw in Bouncy Castle for Java allows adversaries to cause the library to perform a quadratic‑time escaping operation when converting X.500 distinguished names to strings. The excessive time and memory consumption can drain system resources, potentially leading to denial of service. This weakness is categorized as CWE‑407, indicating a performance flaw rather than a classic security boundary breach.

Bouncy Castle products are affected: the standard Java library (BC-JAVA) versions older than 1.85, the long‑term support Java library (BC-LTS-JAVA) versions older than 2.73.12, and the FIPS‑compliant Java library (BC-FJA) versions older than 1.0.2.7, 2.0.2, or 2.1.3. Systems using these libraries should verify their implementation version and ensure they have not deployed an affected release.

The CVSS score of 8.7 indicates a high severity issue. While the EPSS score is not available, the lack of a known KEV listing does not diminish the risk for environments that process untrusted distinguished names. Attackers could trigger the DoS by supplying crafted certificates or directory entries that include complex distinguished names, but actual exploitation requires the affected library to be present in the target. The risk remains significant where the vulnerable library is in use and the application processes external X.500 data.