This vulnerability (CWE-789) in BC-JAVA affects OpenPGP user-attribute subpacket length validation, which is only limited by the maximum memory available to the JVM. This can cause excessive memory allocation, potentially leading to denial of service or resource exhaustion. The affected versions include all versions before 1.85, and versions in the 2.73.x LTS series before 2.73.12. It also affects BC-FJA FIPS versions prior to bcpg-fips 1.0.13 (1.0.X), 2.0.13 (2.0.X), and 2.1.13 (2.1.X). No official remediation level or patch links are provided in the source data.

The vulnerability allows an attacker to cause excessive memory allocation by exploiting the unbounded length of the OpenPGP user-attribute subpacket. This can lead to denial of service conditions due to resource exhaustion. There is no indication of privilege escalation or code execution. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the source data, users should monitor for vendor updates and apply patches once available. Until then, consider limiting input sizes or applying JVM memory constraints as a temporary mitigation if feasible.