CVE-2026-5588

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

HIGH

7.5

CVSS Score

Published: April 15, 2026 at 09:06 AM UTC

Updated: October 26, 2026 at 09:10 PM UTC

12 products affected across 2 vendorsBC JavaBCPKIX FIPSBCPKIX LTS

Using BC-JAVA by Legion of the Bouncy Castle Inc.?

Get instant alerts when new vulnerabilities affect BC-JAVA - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BC Java · Legion of Bouncy Castlemaven

90%

1.67 ≤ v < 1.80.21.81 ≤ v < 1.81.11.82 ≤ v < 1.841.67 1.81 1.82

Affected range stops below 1.80.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.81.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.84, so it looks safe — our inference, not a vendor statement

BCPKIX FIPS · Legion of Bouncy Castlemaven

90%

2.0.6 ≤ v < 2.0.112.1.7 ≤ v < 2.1.112.0.6 2.1.7

Affected range stops below 2.0.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.11, so it looks safe — our inference, not a vendor statement

BCPKIX LTS · Legion of Bouncy Castle

90%

2.73.7 ≤ v < 2.73.112.73.7

Affected range stops below 2.73.11, so it looks safe — our inference, not a vendor statement

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Build of Debezium · Red Hatrpm

60%

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 8 (unaffected)

Vendor states this is fixed in 9 (unaffected)

Fuse · Red Hatrpm

60%

JBoss Enterprise Application Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:1.0.1-4.Final_redhat_00002.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.0.3-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.10.0-46.Final_redhat_00044.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.5.26-2.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.84.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:16.1.0-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.0.3-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.0.5-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.1.4-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.1.4-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.16.0-22.redhat_00057.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.18.8-1.redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.21-5.redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.2.40-1.SP3_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.2.40-2.SP3_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.0-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.3.14-11.SP11_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.40.0-6.redhat_00012.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-24.SP12_redhat_00016.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.5-30.SP12_redhat_00020.1.el9eap (unaffected)

Vendor states this is fixed in 0:3.0.4-5.redhat_00007.1.el9eap (unaffected)

Vendor states this is fixed in 0:3.1.12-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:3.6.1-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:3.6.2-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:3.7.19-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:33.0.0-3.jre_redhat_00004.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.0.6-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.1.132-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.1.135-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:5.0.31-3.SP2_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:6.6.48-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:7.2.6-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:7.4.25-2.GA_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:8.1.1-10.GA_redhat_00017.1.el9eap (unaffected)

Vendor states this is fixed in 0:8.1.6-5.GA_redhat_00007.1.el9eap (unaffected)

Vendor states this is fixed in 0:801.6.0-1.GA_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 1.84.0.redhat-1 (unaffected)

OpenShift AI · Red Hatcontainer

60%

All versions

OpenShift Developer Tools and Services · Red Hatrpm

60%

All versions

Vendor states this is fixed in 1786533561 (unaffected)

Vendor states this is fixed in 1786533565 (unaffected)

Vendor states this is fixed in 1786628667 (unaffected)

Vendor states this is fixed in 1786628681 (unaffected)

Vendor states this is fixed in 1787124632 (unaffected)

Vendor states this is fixed in 1787124635 (unaffected)

Vendor states this is fixed in 1787124779 (unaffected)

Vendor states this is fixed in 1787124925 (unaffected)

Vendor states this is fixed in 1787125069 (unaffected)

Vendor states this is fixed in 1787125166 (unaffected)

Vendor states this is fixed in 1787125311 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (31)

Vendor Advisory

Source: cverecord

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588

Patch

Source: cverecord

https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057