Bug 2510196 (CVE-2026-59641)

Summary: CVE-2026-59641 bouncycastle: bcmail-fips: bcjmail-fips: Bouncy Castle for Java: S/MIME signature validation bypass via signer-asserted signing time
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rstancel, rstepani, thjenkin, vdosoudi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Bouncy Castle for Java. The S/MIME (Secure/Multipurpose Internet Mail Extensions) validator improperly trusts the signing time asserted by the signer during path validation. This could allow an attacker to bypass certificate path validation, potentially leading to the acceptance of invalid or expired certificates. Such an issue can compromise the integrity of signed data.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2524915, 2524924    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-03 02:01:41 UTC
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).