How this vulnerability can be exploited
This issue can be reached with local access to the system, attack complexity is low, an attacker needs administrative privileges on the target. A user must actively cooperate. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability low.
CVSS metrics in full
The score comes from this vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green
- Attack vector: Local — a local account, shell or session on the host is needed.
- Attack complexity: Low — the attack works reliably, with no preparation.
- Attack requirements: Present — the target has to be in a particular state for the attack to work.
- Privileges required: High — administrative rights are needed first.
- User interaction: Active — the victim has to cooperate with the attack.
- Confidentiality impact: None.
- Integrity impact: None.
- Availability impact: Low — limited, and the attacker does not choose what is affected.
Weakness class
CVE-2025-9092 is classified as CWE-400: Uncontrolled Resource Consumption. A request can consume memory, CPU or storage without limit, exhausting capacity for everyone else.
Affected software
CVE-2025-9092 is recorded against 2 packages.
- org.bouncycastle:bc-fips (from 2.1.0 up to 2.1.1)
- unknown
Timeline and source
Published on 16 August 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.
References
nvd.nist.gov (Advisory)
github.com (Package)
github.com (Web)
Other advisories for this package
org.bouncycastle:bc-fips has other advisories on record. If you are patching this one, these are worth checking on the same host:
Same weakness in other software
These advisories are the same class of weakness (CWE-400: Uncontrolled Resource Consumption) in other software:
