HIGH

CVE-2026-59639

Bouncycastle Bc Java 2026-08-03 CVSS v3.1

CVSS

7.5

Description

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Weakness (CWE)

CWE-347 Improper Signature Verification

EPSS Score

0.16%

Probability of exploitation in next 30 days

6th percentile

References

https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0 Patch https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639 Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE