CVE-2026-59643
Received Received - Intake

OpenPGP Inline-Signature Policy Bypass in Bouncy Castle

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-59643
EUVD
EUVD-2026-52031

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bouncy_castle bouncy_castle_for_java to 1.85 (exc)
bouncy_castle bcpg_fips to 2.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Bouncy Castle for Java before version 1.85, there is a flaw where OpenPGP inline-signature policy failures are silently ignored. This means that invalid or untrusted signatures may not be detected, potentially allowing unauthorized or tampered data to be processed without warning.

Detection Guidance

This vulnerability affects Bouncy Castle for Java before 1.85 and BC-FJA before bcpg-fips 2.0.13. Detection involves checking the installed version of Bouncy Castle libraries. Use commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to inspect library versions. If using BC-FJA, verify the bcpg-fips version is 2.0.13 or higher.

Impact Analysis

This vulnerability could allow attackers to bypass signature validation, leading to the acceptance of malicious or altered data. For applications relying on OpenPGP signatures for security, this may result in data integrity issues, unauthorized access, or other security breaches.

Compliance Impact

This vulnerability may impact compliance by undermining data integrity and authentication controls required by standards like GDPR and HIPAA. Failure to detect invalid signatures could lead to unauthorized data access or tampering, violating regulatory requirements for secure data handling.

Mitigation Strategies

Update Bouncy Castle for Java to version 1.85 or later and Bouncy Castle for Java FIPS (BC-FJA) to bcpg-fips 2.0.13 or later to address the OpenPGP inline-signature policy failure issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart