CVE-2026-59643

A flaw was found in Bouncy Castle for Java and Bouncy Castle for Java FIPS (BC-FJA). This vulnerability allows an attacker to bypass OpenPGP inline-signature policy failures, which are silently ignored by the software. This silent disregard of policy failures can lead to a compromise of data integrity, as users may mistakenly believe that signature policies are being enforced when they are not. This could result in the acceptance of maliciously altered or unauthorized data.

This flaw has an Important impact. Bouncy Castle for Java's OpenPGP (bcpg) module silently ignores inline-signature policy failures instead of reporting them to the application. When an application processes OpenPGP-signed data with signature policy constraints, policy violations are not enforced or reported. A remote attacker can exploit this by sending OpenPGP-signed data that violates signature policies. The application will process the data as if the signature policy was satisfied, leading to acceptance of maliciously altered or unauthorized data. This affects applications using Bouncy Castle's bcpg module for OpenPGP signature verification with policy enforcement.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.