synced 5 MIN AGO
01 Record

CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

UnratedPUBLISHEDCNA: mitre
CNA base scoreUnratedNo CNA CVSS vector
View raw JSON

02 Description

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

03 Exploitation and scoring

Exploitation
Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision
Not assessed by CISA
EPSS probability
8.77% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 95.1% of scored records. A rank, not a probability.
NVD base score
7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status
Modified. NVD last modified this record on 2026-06-17.
Red Hat severity
No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2019-10-08 13:39Z7 YR AGO
Last updated
2024-08-05 01:40Z2 YR AGO
Reserved
2019-10-08
Assigning CNA
mitre
Record state
PUBLISHED
Severity
Not rated by the issuing CNA
CNA CVSS vector
Not published by the issuing CNA
Weaknesses
  • CWE-770Allocation of Resources Without Limits or ThrottlingBase
Data version
5.1
Document digest
f647cc667661906d8808950f3eed0db25cd03e73d74d30c2e795712bba50c012

05 Affected products

VendorProductVersionsPlatforms
apachetomeeNot specified—
bouncycastlebc-javaNot specified—
netappactive_iq_unified_managerNot specified—
netapponcommand_api_servicesNot specified—
netapponcommand_workflow_automationNot specified—
netappservice_level_managerNot specified—
oraclebusiness_process_management_suiteNot specified—
oraclecommunications_convergenceNot specified—
oraclecommunications_diameter_signaling_routerNot specified—
oraclecommunications_session_route_managerNot specified—
oracledata_integratorNot specified—
oraclefinancial_services_analytical_applications_infrastructureNot specified—
oracleflexcube_private_bankingNot specified—
oraclehospitality_guest_accessNot specified—
oraclemanaged_file_transferNot specified—
oraclepeoplesoft_enterprise_hcm_global_payroll_switzerlandNot specified—
oraclepeoplesoft_enterprise_peopletoolsNot specified—
oracleretail_xstore_point_of_serviceNot specified—
oraclesoa_suiteNot specified—
oraclewebcenter_portalNot specified—
oracleweblogic_serverNot specified—

06 References