CVE-2026-5588

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

CVSS 4.0 6.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-5588

Published

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-5588

Published

bcpkix

https://www.bouncycastle.org/download/bouncy-castle-java/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Legion of the Bouncy Castle Inc.",
                    "product": "BC-JAVA",
                    "platforms": [
                        "all"
                    ],
                    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
                    "packageName": "bcpkix",
                    "repo": "https://github.com/bcgit/bc-java",
                    "modules": [
                        "pkix"
                    ],
                    "programFiles": [
                        "JcaContentVerifierProviderBuilder.java"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.67",
                            "lessThan": "1.80.2",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "1.81",
                            "lessThan": "1.81.1",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "1.82",
                            "lessThan": "1.84",
                            "versionType": "maven"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

bcpkix

https://www.bouncycastle.org/download/bouncy-castle-java-fips/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Legion of the Bouncy Castle Inc.",
                    "product": "BCPKIX-FIPS",
                    "platforms": [
                        "All"
                    ],
                    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
                    "packageName": "bcpkix",
                    "repo": "https://repo1.maven.org/maven2/org/bouncycastle/bcpkix-fips/",
                    "modules": [
                        "pkix"
                    ],
                    "programFiles": [
                        "JcaContentVerifierProviderBuilder.java"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2.0.6",
                            "lessThan": "2.0.11",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "2.1.7",
                            "lessThan": "2.1.11",
                            "versionType": "maven"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

bcpkix

https://www.bouncycastle.org/download/bouncy-castle-java-lts/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Legion of the Bouncy Castle Inc.",
                    "product": "BCPIX-LTS",
                    "platforms": [
                        "All"
                    ],
                    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
                    "packageName": "bcpkix",
                    "repo": "https://repo1.maven.org/maven2/org/bouncycastle/bcpkix-lts8on/",
                    "modules": [
                        "pkix"
                    ],
                    "programFiles": [
                        "JcaContentVerfierProviderBuilder.java"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2.73.7",
                            "lessThan": "2.73.11",
                            "versionType": "maven"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON