Skip to main content

Bc Java CVE-2019-17359

HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2019-10-08 cve@mitre.org
Denial Of Service Bc Java Tomee Active Iq Unified Manager Oncommand Api Services Oncommand Workflow Automation Service Level Manager Business Process Management Suite Communications Convergence Communications Diameter Signaling Router Communications Session Route Manager Data Integrator Financial Services Analytical Applications Infrastructure Flexcube Private Banking Hospitality Guest Access Managed File Transfer Peoplesoft Enterprise Hcm Global Payroll Switzerland Peoplesoft Enterprise Peopletools Retail Xstore Point Of Service Soa Suite Webcenter Portal Weblogic Server
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 08, 2019 - 14:15 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 maven packages depend on org.bouncycastle:bcprov-jdk14 (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.63.

DescriptionNVD

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

AnalysisAI

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64. Affected products include: Bouncycastle Bc-Java, Apache Tomee, Netapp Active Iq Unified Manager, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.

More in Bc Java

View all
CVE-2017-13098 HIGH POC
7.5 Dec 13

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic

CVE-2020-28052 HIGH POC
8.1 Dec 18

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
CVE-2018-1000613 CRITICAL
9.8 Jul 09

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
CVE-2025-14813 CRITICAL
9.3 Apr 15

GOST CTR block cipher in Bouncy Castle BC-JAVA processes only the first 255 blocks correctly, causing silent data corrup
CVE-2026-5598 HIGH
8.9 Apr 15

Non-constant time comparison operations in the Legion of the Bouncy Castle BC-JAVA cryptographic library (core modules,

CVE-2026-3505 HIGH
8.7 Apr 15

Pre-authentication resource exhaustion in Bouncy Castle BC-JAVA PGP modules (bcpg) allows remote attackers to trigger de
CVE-2018-1000180 HIGH
7.5 Jun 05

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key p
CVE-2026-5588 MEDIUM
6.3 Apr 15

Signature verification bypass in Bouncy Castle BC-JAVA (bcpkix module versions 1.49-1.83) allows remote unauthenticated

CVE-2016-2427 MEDIUM
5.5 Apr 18

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter
CVE-2026-0636 MEDIUM
5.5 Apr 15

LDAP injection in Bouncy Castle BC-JAVA bcprov module (versions 1.49 through 1.83) allows remote unauthenticated attacke
CVE-2023-33201 MEDIUM
5.3 Jul 05

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. Rated medium severity (CVSS 5.3), thi
CVE-2018-5382 MEDIUM
4.4 Apr 16

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2019-17359 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy