CVE-2026-59639
CVE-2026-59639 · CMS verifySignatures returns true for SignedData with zero signers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
CVSS 8.7 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
bc-java
- Versions
- ≥ 0, < 1.85: Affected (maven)
Update to 1.85
bc-lts-java
- Versions
- ≥ 2.73.0, < 2.73.12: Affected (maven)
Update to 2.73.12
bc-fja
- Versions
- ≥ 1.0.0, < 1.0.12: Affected (maven)
- ≥ 2.0.0, < 2.0.12: Affected (maven)
- ≥ 2.1.0, < 2.1.12: Affected (maven)
Update to 1.0.12; Update to 2.0.12; Update to 2.1.12
bouncycastle Debian:12
- Versions
- 1.72-2
- 1.77-1
- 1.80-1
- 1.80-2
- 1.80-3
- 1.86-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Debian:13
- Versions
- 1.80-3
- 1.86-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Debian:14
- Versions
- 1.80-3
- Affected ranges
- ECOSYSTEM: < 1.86-1
Update to 1.86-1
bouncycastle Ubuntu:Pro:16.04:LTS
- Versions
- 1.49+dfsg-3ubuntu1
- 1.51-4ubuntu1
- 1.51-4ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:18.04:LTS
- Versions
- 1.57-1
- 1.58-1
- 1.59-1
- 1.59-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:20.04:LTS
- Versions
- 1.61-1
- 1.61-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:22.04:LTS
- Versions
- 1.68-2
- 1.68-4
- 1.68-5
- 1.68-5ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:Pro:24.04:LTS
- Versions
- 1.72-2
- 1.77-1
- 1.77-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:26.10
- Versions
- 1.80-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bouncycastle Ubuntu:26.04:LTS
- Versions
- 1.80-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published