This vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library arises from the OER parser recursing without a depth limit when processing a self-referential IEEE 1609.2 schema. Affected versions include BC-JAVA before 1.85, LTS versions before 2.73.12, and BC-FJA FIPS versions before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). The uncontrolled recursion can cause excessive resource consumption, leading to denial of service conditions. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability can be exploited remotely without authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The primary impact is high, involving potential denial of service due to resource exhaustion from uncontrolled recursion in the OER parser. No confidentiality, integrity, or availability impacts beyond denial of service are indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by limiting or validating inputs processed by the OER parser where feasible.