This vulnerability in Bouncy Castle for Java arises from unbounded up-front memory allocation when processing definite-length reads, potentially leading to an out-of-memory (OOM) condition. It affects versions before 1.85 of the main Java library, as well as specific older versions of the LTS, FIPS, and TLS FIPS variants. The issue is identified as CWE-789, indicating uncontrolled memory allocation. No patch links are provided in the source data, and no known exploits are reported in the wild. The CVSS 4.0 vector indicates a network attack vector with no privileges or user interaction required, and a high impact on availability due to potential OOM.

Successful exploitation can cause an application using vulnerable Bouncy Castle Java libraries to consume excessive memory, leading to an out-of-memory condition and potential denial of service. There is no indication of confidentiality or integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider limiting input sizes or applying resource constraints to mitigate potential OOM conditions.