Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by bcorg

CVE-2026-5588PKIX draft CompositeVerifier accepts empty signature sequence as valid.

High 7.5

In plain English

A high-severity broken cryptography in BC-JAVA from Legion of the Bouncy Castle Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bouncycastleno fix listedDEBIAN-CVE-2026-5588
Debian:13bouncycastleno fix listedDEBIAN-CVE-2026-5588
Debian:14bouncycastle1.86-1DEBIAN-CVE-2026-5588
Mavenorg.bouncycastle:bcpkix-debug-jdk141.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-debug-jdk15to181.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-debug-jdk18on1.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-jdk141.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-jdk15on1.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-jdk15to181.84GHSA-wg6q-6289-32hp
Mavenorg.bouncycastle:bcpkix-jdk18on1.84GHSA-wg6q-6289-32hp
Ubuntu:25.10bouncycastleno fix listedUBUNTU-CVE-2026-5588
Ubuntu:26.04:LTSbouncycastleno fix listedUBUNTU-CVE-2026-5588
Ubuntu:26.10bouncycastleno fix listedUBUNTU-CVE-2026-5588

Affected products (as reported)

VendorProductVersions
Legion of the Bouncy Castle Inc. BC-JAVA 1.67 – before 1.80.21.81 – before 1.81.11.82 – before 1.84
Legion of the Bouncy Castle Inc. BCPKIX-FIPS 2.0.6 – before 2.0.112.1.7 – before 2.1.11
Legion of the Bouncy Castle Inc. BCPIX-LTS 2.73.7 – before 2.73.11

Weakness: CWE-327, CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References