CVE-2026-59639

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59639
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59639.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59639
Downstream
Related
Published
2026-08-03T00:56:24Z
Modified
2026-09-04T08:12:01Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
CMS verifySignatures returns true for SignedData with zero signers
Details

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Database specific 
{
    "cna_assigner": "bcorg",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59639.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.12"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.12"
                },
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.1.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57fbd3c501f7a369f64eda311d6a709fc0bcae84
Fixed
99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.85"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/bcgit/bc-lts-java
Events
Introduced
468b5082f3f0971e80bf9edb7029c17b39b9ba0c
Fixed
f101b232c5d3e07ecdd504210a57e43831d6cd65
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.73.0"
        },
        {
            "fixed": "2.73.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.73.11"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Other
r1rv73
r1rv74
r1rv75
r1rv76
r1rv77
r1rv78
r1rv80
r1rv81
r1rv82
r1rv83
r1rv84
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59639.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248172216731417060037426735506958763855",
            "length": 683
        },
        "id": "CVE-2026-59639-6cb902cd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/cms/CMSSignedData.java",
            "function": "verifySignatures"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "185519618309092291115967925554021490639",
                "285498038949261599755481916216714326362",
                "121530941554298604575725951597369116772"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-59639-82ae9abc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0",
        "target": {
            "file": "pkix/src/main/java/org/bouncycastle/cms/CMSSignedData.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "233145579337384555099388054335852575167",
                "21237510385395960419545504823732864560",
                "265941787911752798204147949586928044707",
                "173357824411875291744095258129490624732",
                "262883071587641562138437333417383305146",
                "167582624819181027626166757036210382268"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-59639-f647c08e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0",
        "target": {
            "file": "pkix/src/test/java/org/bouncycastle/cms/test/NewSignedDataTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-04T08:12:01Z"