Back to Database
Status published
Unknown
CVE-2025-9340
native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.
Vulnerability Description
Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9340
Credits & Attribution
No credits recorded in the NVD database.
More from Legion of the Bouncy Castle Inc.
View All →CVE-2025-9341
Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion
Medium
5.9
CVE-2025-9092
Hybrid Module Deployment in Multi-JVM Environments Leading to Resource Exhaustion
Low
1
CVE-2025-8916
Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer
Medium
6.3
CVE-2025-8885
Possible DOS in processing specially formed ASN.1 Object Identifiers
Medium
6.3
CVE-2025-14813
GOSTCTR implementation unable to process more than 255 blocks correctly
Critical
9.3
Affected Vendor
Legion of the Bouncy Castle Inc.
View all reports →Affected Software
Bouncy Castle for Java
Vulnerable Versions:
BC-FJA 2.1.0
Timeline
Official Publish:
August 22nd, 2025
Last Modified:
August 22nd, 2025
Added to House:
July 22nd, 2026