CVE-2026-59639

A flaw was found in Bouncy Castle for Java. The library's Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.

Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The CMS verifySignatures method incorrectly returns true for SignedData containing zero signers, so unsigned content may be treated as validly signed — a cryptographic signature-verification bypass with a high integrity impact. This affects applications that rely on Bouncy Castle CMS to verify signatures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpkix-fips 1.0.12/2.0.12/2.1.12) once available for the affected product.