CVE-2026-59639
Received Received - Intake

CMS Signature Verification Bypass in Bouncy Castle Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-59639
EUVD
EUVD-2026-52035

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle_for_java to 1.85 (exc)
bouncy_castle bouncy_castle_for_java_lts to 2.73.12 (exc)
bouncy_castle bouncy_castle_for_java_fips to 1.0.12 (exc)
bouncy_castle bouncy_castle_for_java_fips to 2.0.12 (exc)
bouncy_castle bouncy_castle_for_java_fips to 2.1.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Bouncy Castle for Java versions before 1.85 allows the CMS verifySignatures function to incorrectly return true for SignedData objects that have zero signers. This means cryptographic signatures are not properly validated, potentially allowing unverified or malicious data to be accepted as authentic.

Detection Guidance

This vulnerability can be detected by checking the version of Bouncy Castle libraries in use. For Java applications, inspect the JAR files or dependency manifests for versions before 1.85 (standard), 2.73.12 (LTS), or the specified FIPS versions. No specific commands are provided in the context to directly detect exploitation.

Impact Analysis

This flaw could allow attackers to bypass signature verification, leading to unauthorized access, data tampering, or spoofed communications. Systems relying on Bouncy Castle for Java for cryptographic operations may process invalid or malicious data without detection.

Compliance Impact

This vulnerability may violate compliance requirements that mandate data integrity and authenticity checks, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Failure to validate signatures could result in non-compliance and legal risks.

Mitigation Strategies

Update Bouncy Castle for Java to version 1.85 or later, Bouncy Castle for Java LTS to 2.73.12 or later, and Bouncy Castle for Java FIPS to the specified versions (1.0.12, 2.0.12, 2.1.12) to address the issue with CMS verifySignatures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart