VULNERABILITY INTELLIGENCE

CVE-2026-59639

CVSS score8.7 HIGH
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-08-03
Last modified2026-08-28
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

Description

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Weakness classification

  • CWE-347: Improper Verification of Cryptographic Signature

Primary references