Lucene search

Veracode Vulnerability DatabaseVERACODE:46624

HistoryApr 25, 2024 - 3:54 p.m.

Denial Of Service (DoS)

2024-04-2515:54:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

bouncy castle

ed25519

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Bouncy Castle is vulnerable to an infinite loop. The vulnerability is due to insufficient verification of signatures and public keys during Ed25519 verification, allowing attackers to trigger a denial of service (DoS) due to the infinite loop.

References

github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea49

github.com/bcgit/bc-java/issues/1599

security.netapp.com/advisory/ntap-20240614-0007/

www.bouncycastle.org/latest_releases.html

www.bouncycastle.org/releasenotes.html#:~:text=exception%20processing%20eliminated.-,CVE%2D2024%2D30172,-%2D%20Crafted%20signature%20and