Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

GHSA-wg6q-6289-32hp · CVE-2026-5588

Published Apr 15, 2026 · Modified Apr 17, 2026

Description

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

This issue affects BC-JAVA: from 1.49 before 1.84.

Fix 1.84

Introduced 1.49

3 affected versions

1.811.821.83

Fix 1.84

Introduced 1.49

12 affected versions

1.731.741.751.761.771.781.78.11.791.801.811.821.83

Fix 1.84

Introduced 1.49

11 affected versions

1.731.741.751.761.771.781.78.11.791.811.821.83

Fix 1.84

Introduced 1.49

34 affected versions

1.491.501.511.531.541.551.561.571.581.591.601.611.621.631.641.651.671.681.691.70 +14 more

Fix 1.84

Introduced 1.49

22 affected versions

1.491.501.511.521.531.541.551.561.571.581.591.601.611.621.631.641.651.661.671.68 +2 more

Fix 1.84

Introduced 1.49

22 affected versions

1.631.641.651.661.671.681.691.701.711.721.731.741.751.761.771.781.78.11.791.801.81 +2 more

Fix 1.84

Introduced 1.49

15 affected versions

1.711.71.11.721.731.741.751.761.771.781.78.11.791.801.811.821.83

Ready to move

Free, no credit card | First findings in minutes