Vulnerability in Bouncy Castle for Java Affects CMS AuthenticatedData
CVE-2026-59642

8.7HIGH

Key Information:

Vendor

Legion Of The Bouncy Castle Inc.

Status
Bc-java
Bc-lts-java
Bc-fja
Vendor
CVE Published:
3 August 2026

What is CVE-2026-59642?

An issue exists in Bouncy Castle for Java where the CMS AuthenticatedData content is not bound to the Message Authentication Code (MAC) when authentication attributes (authAttrs) are present. This vulnerability poses a potential threat to data integrity in cryptographic operations, particularly affecting the versions of Bouncy Castle prior to 1.85, as well as specific LTS and FIPS variants. Proper measures should be taken to ensure that systems are updated to mitigate this security risk.

Affected Version(s)

BC-FJA all 1.0.0 < 1.0.12

BC-FJA all 2.0.0 < 2.0.12

BC-FJA all 2.1.0 < 2.1.12

References

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2...
vendor-advisory
https://github.com/bcgit/bc-java/commit/2117f316a5a47308f...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Gaynor in collaboration with Claude and Anthropic Research
.