Multiple Vulnerabilities in Bouncy Castle for Java

Bouncy Castle for Java is affected by several critical vulnerabilities, identified as CVE-2024-29857, CVE-2024-30171, and CVE-2024-30172. These security flaws allow a remote, unauthenticated attacker to manipulate cryptographic operations, bypass security controls, and disclose sensitive information or cause a denial-of-service (DoS) state. Because Bouncy Castle is a widely deployed cryptographic library used by numerous enterprise Java applications, these vulnerabilities represent a significant risk for systems relying on its underlying providers for TLS, data signing, and object serialization. Defenders must assess their application inventory to identify dependencies on the vulnerable versions and coordinate updates with application development teams.

Impact

Successful exploitation of these vulnerabilities could result in the total compromise of cryptographic integrity within the affected Java applications. This potentially leads to the interception of encrypted communications, unauthorized access to secure data, or the complete disruption of services dependent on these cryptographic primitives.

Recommendation

• Identify all Java-based applications within the enterprise environment that bundle or depend on Bouncy Castle libraries.
• Review the official Bouncy Castle project release notes to identify the patched library versions for CVE-2024-29857, CVE-2024-30171, and CVE-2024-30172.
• Update all identified vulnerable application components to the latest patched releases of Bouncy Castle.
• Perform dependency scans using Software Bill of Materials (SBOM) or SCA tooling to ensure no transitive dependencies include the vulnerable Bouncy Castle binaries.