Bug 2510197 (CVE-2026-59639)

Summary: CVE-2026-59639 org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Cryptographic signature bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, anujha, aoconnor, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, bniver, boliveir, bstansbe, dfreiber, dlofthou, drichtar, drow, flucifre, gmeno, groman, istudens, ivassile, iweiss, jburrell, mbenjamin, mhackett, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rstancel, sostapov, ssilvert, sthorger, thjenkin, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Bouncy Castle for Java. The library's Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2523389, 2523390, 2523391    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-03 02:01:43 UTC
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).