CVE-2019-17359

7.5 highEPSS 8.8%

High (7.5). EPSS 8.8% chance of exploitation in the next 30 days. Fixed in org.bouncycastle:bcprov-jdk14 1.64.

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 8.8% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-11-01)
CWE: CWE-770
Published: 2019-10-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:tomee
bouncycastle:bc-java
netapp:active_iq_unified_manager
netapp:oncommand_api_services
netapp:oncommand_workflow_automation
netapp:service_level_manager
oracle:business_process_management_suite
oracle:communications_convergence
oracle:communications_diameter_signaling_router
oracle:communications_session_route_manager
oracle:data_integrator
oracle:financial_services_analytical_applications_infrastructure
oracle:flexcube_private_banking
oracle:hospitality_guest_access
oracle:managed_file_transfer
oracle:peoplesoft_enterprise_hcm_global_payroll_switzerland
oracle:peoplesoft_enterprise_peopletools
oracle:retail_xstore_point_of_service
oracle:soa_suite
oracle:webcenter_portal
oracle:weblogic_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-2mh8-gx2m-mr75	Maven	org.bouncycastle:bcprov-jdk14	>=1.63 <1.64	1.64

References

Check your stack JSON