CVE-2026-59639

Published: Aug 3, 2026Modified: Aug 28, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less

Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Affected (5)

Products: Bouncycastle: Bc Java, Bcpkix Fips, Bouncy Castle For Java Lts

Bouncycastle

3 products

Bc Java

Bcpkix Fips

Bouncy Castle For Java Lts

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Before 1.85
Bouncycastle Bcpkix Fips	Before 1.0.12
Bouncycastle Bcpkix Fips	From 2.0.7 to 2.0.12
Bouncycastle Bcpkix Fips	From 2.1.8 to 2.1.12
Bouncycastle Bouncy Castle For Java Lts	Up to 2.73.11

Related CWEs

CWE-347

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (2)

https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Patch

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Third Party Advisory

Timeline

No history available yet.