CVE-2024-29857

CVSS 7.5 · HIGH

EPSS p64

Higher than 64% of all CVEs — moderate exploitation risk.

No patch reference

No patch/mitigation in references

Published 5/14/2024 · updated 6/17/2026 · CWE-125

Summary

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

CVSS 7.5 — HIGH

7.5 / 10

AV: Network
AC: Low complexity
PR: No privileges
UI: No user interaction
S: Scope unchanged
C: Confidentiality: None
I: Integrity: None
A: Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS exploitation probability

1.1%

Percentile p64 — Higher than 64% of all CVEs — moderate exploitation risk.

Timeline

May 14, 2024 · Disclosed / published in NVD
Jun 17, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

NVD· today
CVE.org· today
FIRST EPSS· today
CISA KEV· no data
OSV· today

References

Other7

Unlock the full report

See how CVE-2024-29857 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

· Asset-aware CVSS & priority
· Grounded AI analysis (A–D graded)
· Auto-generated WAF / IPS rules
· Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.