{"id":"GHSA-wjxj-5m7g-mg7q","summary":"Bouncy Castle Denial of Service (DoS)","details":"Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.","aliases":["CVE-2023-33202"],"modified":"2026-07-17T21:16:08.621066004Z","published":"2023-11-23T18:30:33Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-11-24T16:54:01Z","nvd_published_at":"2023-11-23T16:15:07Z","cwe_ids":["CWE-400"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33202"},{"type":"WEB","url":"https://github.com/bcgit/bc-java/commit/0c576892862ed41894f49a8f639112e8d66d229c"},{"type":"WEB","url":"https://bouncycastle.org"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"},{"type":"WEB","url":"https://github.com/bcgit/bc-java/wiki/CVE-2023-33202"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240125-0001"}],"affected":[{"package":{"name":"org.bouncycastle:bcprov-ext-jdk16","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-ext-jdk16"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.45","1.46"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk14","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk14"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.38","1.43","1.44","1.45","1.46","1.47","1.48","1.49","1.50","1.51","1.53","1.54","1.55","1.56","1.57","1.58","1.59","1.60","1.61","1.62","1.63","1.64","1.65","1.67","1.68","1.69","1.70","1.71","1.72"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk15","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.32","1.38","1.40","1.43","1.44","1.45","1.46"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.63","1.64","1.65","1.66","1.67","1.68","1.69","1.70","1.71","1.72"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk16","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk16"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.38","1.40","1.43","1.44","1.45","1.46"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk15on","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15on"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.46","1.47","1.48","1.49","1.50","1.51","1.52","1.53","1.54","1.55","1.56","1.57","1.58","1.59","1.60","1.61","1.62","1.63","1.64","1.65","1.65.01","1.66","1.67","1.68","1.69","1.70"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json","last_known_affected_version_range":"\u003c 1.70"}},{"package":{"name":"org.bouncycastle:bcpkix-jdk18on","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk18on"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.71","1.71.1","1.72"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-ext-jdk15on","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-ext-jdk15on"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.46","1.47","1.48","1.49","1.50","1.51","1.52","1.53","1.54","1.55","1.56","1.57","1.58","1.59","1.60","1.61","1.62","1.63","1.64","1.65","1.66","1.67","1.68","1.69","1.70"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}},{"package":{"name":"org.bouncycastle:bcprov-jdk18on","ecosystem":"Maven","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73"}]}],"versions":["1.71","1.71.1","1.72"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-wjxj-5m7g-mg7q/GHSA-wjxj-5m7g-mg7q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}