Description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).

This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.



This issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
Published: 2026-04-15
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Use of a broken or risky cryptographic algorithm in Bouncy Castle Inc.'s PKIX CompositeVerifier, implemented in JcaContentVerifierProviderBuilder.Java and JcaContentVerfierProviderBuilder.Java, results in an empty signature sequence being accepted as valid. Classified as CWE-327 and CWE-347, this flaw appears in all pkix modules of BC-JAVA, BCPKIX-FIPS, and BCPIX-LTS within the specified version ranges. The vulnerability allows an attacker to craft a certificate chain with no valid signatures that the verifier will accept, effectively enabling the creation of trusted certificates without proper validation.

Affected Systems

The issue impacts Bouncy Castle Inc.’s BC‑JAVA library from version 1.67 up to 1.83, the BCPKIX‑FIPS library from version 2.0.6 before 2.0.11 and from 2.1.7 before 2.1.11, and the BCPIX‑LTS library from version 2.73.7 before 2.73.11. All Java applications that depend on the bc‑pkix module, the BCPKIX‑FIPS package, or the BCPIX‑LTS library in these releases are vulnerable until an upgraded version is installed.

Risk and Exploitability

The vulnerability has a CVSS score of 6.3. The EPSS score indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the construction of a forged certificate chain. Any application that performs PKIX verification using the affected library could be compromised. Without an available exploit track, the risk remains significant because the flaw enables the attacker to bypass certificate validation entirely, granting them authority equivalent to a trusted party.

Generated by OpenCVE AI on May 8, 2026 at 06:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Bouncy Castle BC-JAVA library to version 1.84 or later.
  • Update the Bouncy Castle BCPKIX‑FIPS library to version 2.0.11 or later, or 2.1.11 or later.
  • Update the Bouncy Castle BCPIX‑LTS library to version 2.73.11 or later.
  • For applications that cannot upgrade immediately, modify the certificate validation logic to reject certificates with an empty signature sequence.
  • Consider using an alternative cryptographic library or enabling stricter PKIX validation if available within your environment.

Generated by OpenCVE AI on May 8, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wg6q-6289-32hp Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
History

Fri, 08 May 2026 05:45:00 +0000

Type Values Removed Values Added
Description Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11. Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Wed, 29 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-347
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

threat_severity

Important

Tue, 21 Apr 2026 16:00:00 +0000

Type Values Removed Values Added
Description Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).This issue affects BC-JAVA: from 1.67 before 1.84. Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green'}

 cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber'}

Tue, 21 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Description : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84. Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).This issue affects BC-JAVA: from 1.67 before 1.84.
References

Wed, 15 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green'}

Wed, 15 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Bouncycastle
Bouncycastle bc-java
Vendors & Products Bouncycastle
Bouncycastle bc-java

Wed, 15 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84.
Title PKIX draft CompositeVerifier accepts empty signature sequence as valid.
Weaknesses CWE-327
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Bouncycastle Bc-java
cve-icon MITRE

Status: PUBLISHED

Assigner: bcorg

Published:

Updated: 2026-05-08T05:29:40.247Z

Reserved: 2026-04-04T23:50:59.336Z

Link: CVE-2026-5588

cve-icon Vulnrichment

Updated: 2026-04-15T13:11:21.652Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-15T10:16:49.597

Modified: 2026-05-08T06:16:10.540

Link: CVE-2026-5588

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-15T09:06:15Z

Links: CVE-2026-5588 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-08T07:00:04Z

Weaknesses