8.7
High
CVE-2026-59639 In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers
Description
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| BC-JAVA 1.85 | earliest → < 1.85 | 1.85 |
| BC-LTS-JAVA 2.73 | 2.73.0 → < 2.73.12 | 2.73.12 |
| BC-FJA 2.1 | 2.1.0 → < 2.1.12 | 2.1.12 |
| BC-FJA 2.0 | 2.0.0 → < 2.0.12 | 2.0.12 |
| BC-FJA 1.0 | 1.0.0 → < 1.0.12 | 1.0.12 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of BC-JAVA
The 52 CVEs of BC-JAVA →
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list,…
8.7
High
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every…
7.1
High
CVE-2026-18040
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8)…
5.9
Medium
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509…
9.2
Critical