What’s Vulnerable › Vulnerabilities

CVE-2023-33202

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-23 · updated 2026-06-17
• Weakness: CWE-400

Description

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)

Affected products

• Legion of the Bouncy Castle Inc. Bouncy Castle for Java: before 1.73 — fixed in 1.73
• Bouncycastle Fips Java Api: before 1.0.2.4 — fixed in 1.0.2.4

How to fix

Upgrade to a fixed version: Legion of the Bouncy Castle Inc. Bouncy Castle for Java 1.73; Bouncycastle Fips Java Api 1.0.2.4. Check the vendor advisory for mitigations.

References

• https://bouncycastle.org
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902023%E2%80%9033202
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33202
• https://security.netapp.com/advisory/ntap-20240125-0001/
• https://bouncycastle.org
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33202
• https://security.netapp.com/advisory/ntap-20240125-0001/

Get alerted when CVE-2023-33202 or the next vulnerability affects your stack