CVEvulnerability

CVE-2026-59639

8.7 HIGH Published 2026-08-03 Modified 2026-08-28 Official page ↗
Status
Analyzed
Published
2026-08-03
Last modified
2026-08-28
Assigner
91579145-5d7b-4cc5-b925-a0262ff19630
CVSS 4.0 (91579145-5d7b-4cc5-b925-a0262ff19630)
8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347

Description

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Affected configurations

• bouncycastle bc-java (< 1.85) • bouncycastle bcpkix-fips (< 1.0.12) • bouncycastle bcpkix-fips (>= 2.0.7 < 2.0.12) • bouncycastle bcpkix-fips (>= 2.1.8 < 2.1.12) • bouncycastle bouncy castle for java lts (<= 2.73.11)

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References