High severity7.5OSV Advisory· Published Aug 3, 2026· Updated Aug 28, 2026
CVE-2026-59639
CVE-2026-59639
Description
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- Range: r2rv73dot11, r2rv73dot10, r2rv73dot9, …
- Range: <1.85, <2.73.12, <1.0.12, <2.0.12, <2.1.12
- osv-coords2 versionspkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Tumbleweed
< 1.85-160000.1.1+ 1 more
- (no CPE)range: < 1.85-160000.1.1
- (no CPE)range: < 1.85-1.1
Patches
Vulnerability mechanics
References
1News mentions
1- Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026Vypr Intelligence · Aug 3, 2026