7.5
CVE-2026-59639
- EPSS 0.17%
- Veröffentlicht 03.08.2026 00:56:24
- Zuletzt bearbeitet 28.08.2026 15:33:16
- Erkennungen
LoginCMS verifySignatures returns true for SignedData with zero signers
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bouncycastle ≫ Bc-java Version < 1.85
Bouncycastle ≫ Bcpkix-fips Version < 1.0.12
Bouncycastle ≫ Bcpkix-fips Version >= 2.0.7 < 2.0.12
Bouncycastle ≫ Bcpkix-fips Version >= 2.1.8 < 2.1.12
Bouncycastle ≫ Bouncy Castle For Java Lts Version <= 2.73.11
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.17% | 0.071 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| 91579145-5d7b-4cc5-b925-a0262ff19630 | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
|
CWE-347 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639