Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-59639 CMS Signature Verification Bypass in Bouncy Castle for Java Before 1.85 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59639
Post summary
The post announces CVE-2026-59639, a CMS signature verification bypass affecting Bouncy Castle Java libraries before v1.85, without providing exploit code, active use reports, or mitigation details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bouncycastle | bc-java | - | - | - |
| App | bouncycastle | bcpkix-fips | - | - | - |
| App | bouncycastle | bouncy_castle_for_java_lts | - | - | - |