CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid.
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
This issue affects BC-JAVA: from 1.49 before 1.84.
Other sources
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5588?
CVE-2026-5588 is considered a moderate severity vulnerability due to its potential impact on cryptographic integrity.
How do I fix CVE-2026-5588?
To fix CVE-2026-5588, update the Bouncy Castle BC-JAVA bcpkix library to version 1.84 or later.
What impact does CVE-2026-5588 have on my application?
CVE-2026-5588 allows the acceptance of empty signature sequences, which may lead to verification of invalid signatures.
Is CVE-2026-5588 related to any specific software versions?
Yes, CVE-2026-5588 affects all versions of Bouncy Castle BC-JAVA bcpkix between 1.49 and 1.84.
Who is affected by CVE-2026-5588?
Any application using the affected versions of Bouncy Castle BC-JAVA bcpkix library is vulnerable to CVE-2026-5588.