CVE-2026-5588
published 2026-04-15CVE-2026-5588: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.64%
48.4th percentile
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| candlepinproject | candlepin | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| legion_of_the_bouncy_castle_inc | bc-java | >= 1.67 < 1.80.2 | 1.80.2 |
| legion_of_the_bouncy_castle_inc | bc-java | >= 1.81 < 1.81.1 | 1.81.1 |
| legion_of_the_bouncy_castle_inc | bc-java | >= 1.82 < 1.84 | 1.84 |
| legion_of_the_bouncy_castle_inc | bcpix-lts | >= 2.73.7 < 2.73.11 | 2.73.11 |
| legion_of_the_bouncy_castle_inc | bcpkix-fips | — | — |
| legion_of_the_bouncy_castle_inc | bcpkix-fips | >= 2.0.6 < 2.0.11 | 2.0.11 |
| legion_of_the_bouncy_castle_inc | bcpkix-fips | >= 2.1.7 < 2.1.11 | 2.1.11 |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| pki-core_10.6 | resteasy | — | — |
| pki-deps_10.6 | resteasy | — | — |
| redhat | resteasy | — | — |
| rhoai | odh-modelmesh-rhel8 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| satellite_el8 | candlepin | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
vendor_redhat·2026-04-15·CVSS 6.3
CVE-2026-5588 [MEDIUM] CWE-347 bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, p
VulDB
Legion of the Bouncy Castle BC-JAVA up to 1.83 risky encryption
vuldb·2026-04-15·CVSS 6.3
CVE-2026-5588 [MEDIUM] Legion of the Bouncy Castle BC-JAVA up to 1.83 risky encryption
A vulnerability was found in Legion of the Bouncy Castle BC-JAVA up to 1.83. It has been declared as problematic. Impacted is an unknown function. Such manipulation leads to risky cryptographic algorithm.
This vulnerability is uniquely identified as CVE-2026-5588. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
GHSA-wg6q-6289-32hp: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
ghsa_unreviewed·2026-04-15
CVE-2026-5588 [MEDIUM] CWE-327 GHSA-wg6q-6289-32hp: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
This issue affects BC-JAVA: from 1.49 before 1.84.
GHSA
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
ghsa·2026-04-15
CVE-2026-5588 [MEDIUM] CWE-327 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
This issue affects BC-JAVA: from 1.49 before 1.84.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-5588 pdfbox: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 pdfbox: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 pdfbox: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 mariadb-java-client: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 mariadb-java-client: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 mariadb-java-client: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 resteasy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 resteasy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 resteasy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 byte-buddy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 byte-buddy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 byte-buddy: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
CVE-2026-5588 voms-api-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
bugzilla·2026-04-28·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
CVE-2026-5588 canl-java: PKIX draft CompositeVerifier accepts empty signature sequence as valid [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5588 bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
bugzilla·2026-04-15·CVSS 6.3
CVE-2026-5588 [MEDIUM] CVE-2026-5588 bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
CVE-2026-5588 bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
This issue affects BC-JAVA: from 1.49 before 1.84.
https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588https://access.redhat.com/errata/RHSA-2026:11720https://access.redhat.com/errata/RHSA-2026:11721https://access.redhat.com/errata/RHSA-2026:13631https://access.redhat.com/errata/RHSA-2026:14272https://access.redhat.com/errata/RHSA-2026:14276https://access.redhat.com/errata/RHSA-2026:17668https://access.redhat.com/errata/RHSA-2026:18054https://access.redhat.com/errata/RHSA-2026:18055https://access.redhat.com/errata/RHSA-2026:18059https://access.redhat.com/errata/RHSA-2026:21772https://access.redhat.com/errata/RHSA-2026:53644https://access.redhat.com/errata/RHSA-2026:53806https://access.redhat.com/errata/RHSA-2026:60239https://access.redhat.com/errata/RHSA-2026:60246https://access.redhat.com/errata/RHSA-2026:60247https://access.redhat.com/errata/RHSA-2026:60248https://access.redhat.com/errata/RHSA-2026:60249https://access.redhat.com/errata/RHSA-2026:60250https://access.redhat.com/errata/RHSA-2026:60251https://access.redhat.com/errata/RHSA-2026:60252https://access.redhat.com/errata/RHSA-2026:60254https://access.redhat.com/errata/RHSA-2026:60256https://access.redhat.com/errata/RHSA-2026:60259https://access.redhat.com/security/cve/CVE-2026-5588https://bugzilla.redhat.com/show_bug.cgi?id=2458634https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json
2026-04-15
Published