Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-5588

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
bcorg

Description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Legion of the Bouncy Castle Inc. BC-JAVA

Default version status: unaffected

  • 1.67 to < 1.80.2affected
  • 1.81 to < 1.81.1affected
  • 1.82 to < 1.84affected

Legion of the Bouncy Castle Inc. BCPKIX-FIPS

Default version status: unaffected

  • 2.0.6 to < 2.0.11affected
  • 2.1.7 to < 2.1.11affected

Legion of the Bouncy Castle Inc. BCPIX-LTS

Default version status: unaffected

  • 2.73.7 to < 2.73.11affected

References