The vulnerability in Bouncy Castle for Java prior to version 1.85, including LTS versions before 2.73.12 and FIPS versions before bc-fips 1.0.2.7 (1.0.X), 2.0.2 (2.0.X), and 2.1.3 (2.1.X), involves quadratic-time escaping when stringifying X.500 distinguished names. This inefficiency can cause excessive CPU usage, potentially leading to denial-of-service conditions. The issue is categorized under CWE-407 (Improper Resource Management). No known exploits are reported in the wild, and no patch links are provided in the data.

The vulnerability can cause high CPU resource consumption due to quadratic-time processing when escaping X.500 distinguished names. This may lead to denial-of-service conditions or degraded performance in applications using affected Bouncy Castle versions. No direct evidence of remote code execution or data breach is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor vendor communications for updates. Until a fix is available, consider limiting exposure to untrusted input that triggers X.500 distinguished name stringification or applying application-level resource controls to mitigate potential denial-of-service impact.