Skip to content
Fencer Vulns
high 7.5

CVE-2024-29857 json

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

published 2024-05-09 2 y ago modified 2026-09-10 1 mo ago also GHSA-8xfc-gm6g-vgpv , EUVD-2024-1533

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Patch / fix

  • maven org.bouncycastle:bcprov-jdk18on 1.78
  • maven org.bouncycastle:bcprov-jdk15on 1.78
  • maven org.bouncycastle:bcprov-jdk15to18 1.78
  • maven org.bouncycastle:bcprov-jdk14 1.78
  • maven org.bouncycastle:bctls-jdk18on 1.78
  • maven org.bouncycastle:bctls-jdk14 1.78
  • maven org.bouncycastle:bctls-jdk15to18 1.78
  • maven org.bouncycastle:bc-fips 1.0.2.5
  • nuget BouncyCastle.Cryptography 2.3.1
  • bouncycastle Debian 14, Debian 13 1.80-1

debian advisories DEBIAN-CVE-2024-29857

  • bouncycastle Ubuntu Pro 18.04 LTS 1.59-1ubuntu0.1~esm1
  • bouncycastle Ubuntu Pro 20.04 LTS 1.61-1ubuntu0.1~esm1
  • bouncycastle Ubuntu Pro 22.04 LTS 1.68-5ubuntu0.1~esm1
  • bouncycastle Ubuntu Pro 24.04 LTS 1.77-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-29857

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform 7.4 4.1.108-1.Final_redhat_00001.1.el9eap
  • eap7-jandex jboss enterprise application platform 7.4 2.4.5-1.Final_redhat_00001.1.el9eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.18-1.GA_redhat_00001.1.el9eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.33-1.SP1_redhat_00001.1.el9eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.23-1.Final_redhat_00001.1.el9eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.17-1.Final_redhat_00001.1.el9eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.108-1.Final_redhat_00001.1.el9eap
  • eap7-bouncycastle jboss enterprise application platform 7.4 1.78.1-1.redhat_00002.1.el9eap

red hat advisories RHSA-2024:5145RHSA-2024:5144RHSA-2024:5143RHSA-2024:5481RHSA-2024:5479

  • itextpdf openSUSE Tumbleweed 5.5.13.4-1.1
  • bouncycastle openSUSE Tumbleweed 1.78.1-1.1

opensuse advisories openSUSE-SU-2025:15739-1openSUSE-SU-2024:13914-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29857 updated cvss 6.5

org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service

  • Red Hat build of Apache Camel 4 for Quarkus 3 org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on
    affected: workaround, no fix available
  • Red Hat build of Apache Camel for Spring Boot 3 org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Keycloak org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on Red Hat JBoss Enterprise Application Platform Expansion Pack org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on
    affected: workaround, no fix available
  • Red Hat streams for Apache Kafka org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AMQ Broker 7
    fixed: vendor fix RHSA-2024:4271
  • Red Hat Build of Apache Camel 4.4 for Quarkus 3.8
    fixed: vendor fix RHSA-2024:4505
  • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
    fixed: vendor fix RHSA-2024:4884
  • Red Hat build of Quarkus 3.8.5.redhat bcprov-jdk18on 1.78.1.redhat-00002
    fixed: vendor fix RHSA-2024:4326
show 8 more
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-bouncycastle 1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-mail 1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-pkix 1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-prov 1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-util 1.78.1-1.redhat_00002.1.el7eap
    fixed: vendor fix RHSA-2024:5143
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-bouncycastle 1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-mail 1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-pkix 1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-prov 1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-util 1.78.1-1.redhat_00002.1.el8eap
    fixed: vendor fix RHSA-2024:5144
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-bouncycastle 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-mail 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-pkix 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-prov 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-util 1.78.1-1.redhat_00002.1.el9eap
    fixed: vendor fix RHSA-2024:5145
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-bouncycastle 1.78.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg 1.78.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-pkix 1.78.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-prov 1.78.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-util 1.78.1-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail 1.78.1-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2024:5479
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-jaxb 4.0.5-2.redhat_00001.1.el9eap, eap8-txw2 4.0.5-2.redhat_00001.1.el9eap, eap8-xsom 4.0.5-2.redhat_00001.1.el9eap, eap8-angus 2.0.3-1.redhat_00001.1.el9eap, eap8-rngom 4.0.5-2.redhat_00001.1.el9eap, eap8-wss4j 3.0.3-1.redhat_00008.1.el9eap, +181 more
    fixed: vendor fix RHSA-2024:5481
  • Red Hat JBoss Enterprise Application Platform bcprov-jdk18on 1.78.1.redhat-00002
    fixed: vendor fix RHSA-2024:5147
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2024:5482
  • Red Hat Cryostat 2 org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on Red Hat build of Quarkus 3.8.5.redhat jna 5.8.0, lit 3.1.2, db2 1.19.6, h2 2.2.224, y18n 5.0.8, bson 4.11.1, +960 more Red Hat Data Grid 8 org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on Red Hat Fuse 7 org.bouncycastle:bcprov-jdk18on org.bouncycastle:bcprov-jdk18on Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el7eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap, eap7-netty-all 4.1.108-1.Final_redhat_00001.1.el7eap, eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el7eap, +47 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el8eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el8eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el8eap, eap7-netty-all 4.1.108-1.Final_redhat_00001.1.el8eap, eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el8eap, +48 more
    +3 more products
    Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el9eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el9eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el9eap, eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el9eap, eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el9eap, eap7-ironjacamar 1.5.17-1.Final_redhat_00001.1.el9eap, +47 more Red Hat JBoss EAP 8.0 for RHEL 8 eap8-jaxb 4.0.5-2.redhat_00001.1.el8eap, eap8-txw2 4.0.5-2.redhat_00001.1.el8eap, eap8-xsom 4.0.5-2.redhat_00001.1.el8eap, eap8-angus 2.0.3-1.redhat_00001.1.el8eap, eap8-rngom 4.0.5-2.redhat_00001.1.el8eap, eap8-wss4j 3.0.3-1.redhat_00008.1.el8eap, +175 more Red Hat JBoss Enterprise Application Platform pom.xml, jansi.dll, libjansi.so, xsdlib 2013.6.1, isorelax 20090621, artemis-service.exe, +722 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 7.5

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
maven org.bouncycastle:bcprov-jdk18on
<1.78
1.78
maven org.bouncycastle:bcprov-jdk15on
<1.78
1.78
maven org.bouncycastle:bcprov-jdk15to18
<1.78
1.78
maven org.bouncycastle:bcprov-jdk14
<1.78
1.78
maven org.bouncycastle:bctls-jdk18on
<1.78
1.78
maven org.bouncycastle:bctls-jdk14
<1.78
1.78
maven org.bouncycastle:bctls-jdk15to18
<1.78
1.78
maven org.bouncycastle:bc-fips
<1.0.2.5
1.0.2.5
nuget BouncyCastle
all versions
 no fix listed
nuget BouncyCastle.Cryptography
<2.3.1
2.3.1

Affected products

  • bouncycastle bc-java
  • bouncycastle bc-fja
  • bouncycastle bc_c_.net

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.