CVE-2026-59643

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59643
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59643.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59643
Downstream
CGA (2)
CLEANSTART (6)
DEBIAN (1)
openSUSE (2)
SUSE (3)
UBUNTU (1)
Related
openSUSE (2)
SUSE (3)
Published
2026-08-03T00:51:55Z
Modified
2026-10-22T16:35:39Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
OpenPGP inline-signature policy failures silently ignored
Details

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

Database specific 
{
    "cna_assigner": "bcorg",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59643.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "2.0.12"
                        },
                        {
                            "fixed": "2.0.13"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
228211ecb973fe87fdd0fc4ab16ba0446ec1a29c
Fixed
57fbd3c501f7a369f64eda311d6a709fc0bcae84
Fixed
d3f8cc408b4a36d28e5a410c93436fe3d0fe726b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.81"
                },
                {
                    "fixed": "1.85"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "d3f8cc408b4a36d28e5a410c93436fe3d0fe726b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
r1rv81
r1rv82
r1rv83
r1rv84

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59643.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "184314506296968296834628895340523483982",
            "length": 759
        },
        "id": "CVE-2026-59643-4abb0453",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target": {
            "file": "pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPMessageInputStream.java",
            "function": "verify"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "257849678814626671772879863135859850558",
                "124386593663936172113173685244098185521",
                "162529091931910546808930903182153008454"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-59643-9202726d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target": {
            "file": "pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPMessageInputStream.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "172557102128809386266827450075305921969",
                "42531372055468316586461977645059231492",
                "160647408479682087836198968712110396396",
                "86469570113435410839828717691358614367",
                "177008846472015520334544926763955714417",
                "82835921102860577221632520033368595867",
                "238170072923511013552432574084480307582",
                "170590701737993671665047275272717645692",
                "73771180015333184558221933947568112570",
                "235738781034188994572505567880883319758",
                "136869947080642571612808836682656351009",
                "311136713775573870709133661747432114881",
                "17962498063518198443482594504675445086",
                "137903700804039137170975108313969361104"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-59643-cbebd152",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target": {
            "file": "pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPMessageProcessorTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "249351862657477541506197813181157570852",
            "length": 581
        },
        "id": "CVE-2026-59643-f73d9bc1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target": {
            "file": "pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPMessageProcessorTest.java",
            "function": "performTestWith"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T16:35:39Z"