{"id":"CVE-2024-29857","aliases":["GHSA-8xfc-gm6g-vgpv"],"url":"https://o3.security/vulnerability/CVE-2024-29857","summary":"Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.","details":"An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.","published":"2024-05-14T15:17:02Z","modified":"2026-04-10T05:11:56.638993Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.011,"percentile":0.62562,"asOf":"2026-08-09"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk18on","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15on","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk15to18","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bcprov-jdk14","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk18on","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk14","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bctls-jdk15to18","fixedVersion":"1.78"},{"ecosystem":"Maven","name":"org.bouncycastle:bc-fips","fixedVersion":"1.0.2.5"},{"ecosystem":"NuGet","name":"BouncyCastle","fixedVersion":null},{"ecosystem":"NuGet","name":"BouncyCastle.Cryptography","fixedVersion":"2.3.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241206-0008/"},{"type":"WEB","url":"https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857"},{"type":"WEB","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857"},{"type":"WEB","url":"https://www.bouncycastle.org/latest_releases.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-10T05:11:56.638993Z"}}