An OER parser in Bouncy Castle for Java libraries recurses without a depth limit when processing a self‑referential IEEE 1609.2 schema. The unchecked recursion causes the Java Virtual Machine to allocate an unbounded number of stack frames, leading to a stack overflow that crashes the JVM and terminates any application component that parses such a schema. The flaw results in a denial of service through resource exhaustion rather than compromising confidentiality, integrity, or authentication. The weakness is an example of uncontrolled recursion (CWE‑674).

The vulnerability affects Bouncy Castle for Java (BC‑JAVA) versions prior to 1.85, Bouncy Castle for Java LTS (BC‑LTS‑JAVA) versions before 2.73.12, and Bouncy Castle for Java FIPS (BC‑FJA) packages bundled in bcutil‑fips releases earlier than 2.0.7 (series 2.0.X) and 2.1.7 (series 2.1.X). Any application or service that incorporates these libraries and parses IEEE 1609.2 schemas is potentially impacted.

Because a malicious IEEE 1609.2 schema can be supplied from any remote source, the vulnerability can be triggered without elevated privileges or authentication. The EPSS score of less than 1 % indicates limited publicly observed exploitation, yet the CVSS score of 8.7 reflects a high potential impact for those who can deliver the crafted schema. The flaw is listed outside the CISA KEV catalog and therefore currently has no known widely‑publicized exploits. Nonetheless, the lack of a stack depth limit warrants immediate attention by organizations using the affected Bouncy Castle components.