← Back

CVE-2026-59641

nvd nist
Published: Aug 3, 2026Modified: Aug 28, 2026

JSON object

Loading...
8.7
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less
Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

Affected (8)

Bouncycastle
4 products
Bc Java
Bcjmail Fips
Bcmail Fips
Bouncy Castle For Java Lts
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Bc Java
Before 1.85
Bouncycastle
Bcjmail Fips
Before 1.0.7
Bcjmail Fips
From 2.0.5 to 2.0.7
Bcjmail Fips
From 2.1.6 to 2.1.7
Bouncycastle
Bcmail Fips
Before 1.0.7
Bcmail Fips
From 2.0.5 to 2.0.7
Bcmail Fips
From 2.1.6 to 2.1.7
Bouncy Castle For Java Lts
Up to 2.73.11

Related CWEs

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (3)

Source: 91579145-5d7b-4cc5-b925-a0262ff19630
Patch
Source: 91579145-5d7b-4cc5-b925-a0262ff19630
Patch
Source: 91579145-5d7b-4cc5-b925-a0262ff19630
Third Party Advisory

Timeline

No history available yet.