This vulnerability (CWE-407) in Legion of the Bouncy Castle Inc.'s BC-JAVA library results from inefficient algorithmic complexity during the escaping process of X.500 distinguished names. The issue causes operations to run in quadratic time, potentially leading to performance degradation or denial of service under certain conditions. Affected versions include BC-JAVA before 1.85, LTS versions from 2.73.0 up to but not including 2.73.12, and specific BC-FJA FIPS versions prior to 1.0.2.7, 2.0.2, and 2.1.3. No official patch or remediation level is currently documented in the provided data.

The vulnerability can lead to significant performance issues due to quadratic-time complexity in string escaping, which may be exploited to cause denial of service by resource exhaustion. There are no known exploits in the wild as of the published date. The CVSS 4.0 score of 8.7 reflects a high impact with network attack vector, no privileges or user interaction required, and high vulnerability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the available data, users should monitor the vendor's announcements for patches addressing this issue. Until a fix is available, consider mitigating exposure by limiting input sizes or usage scenarios involving X.500 distinguished name stringification if feasible.