CVE-2026-59643

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59643
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59643.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59643
Downstream
CLEANSTART (4)
DEBIAN (1)
openSUSE (2)
SUSE (3)
UBUNTU (1)
Related
openSUSE (2)
SUSE (3)
Published
2026-08-03T00:51:55Z
Modified
2026-10-21T10:26:51Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
OpenPGP inline-signature policy failures silently ignored
Details

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

Database specific 
{
    "cna_assigner":  "bcorg",
    "cwe_ids":  [
        "CWE-347"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59643.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.12"
                        },
                        {
                            "fixed":  "2.0.13"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
228211ecb973fe87fdd0fc4ab16ba0446ec1a29c
Fixed
57fbd3c501f7a369f64eda311d6a709fc0bcae84
Fixed
d3f8cc408b4a36d28e5a410c93436fe3d0fe726b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.81"
                },
                {
                    "fixed":  "1.85"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "d3f8cc408b4a36d28e5a410c93436fe3d0fe726b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
r1rv81
r1rv82
r1rv83
r1rv84

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59643.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "184314506296968296834628895340523483982",
            "length":  759
        },
        "id":  "CVE-2026-59643-4abb0453",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target":  {
            "file":  "pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPMessageInputStream.java",
            "function":  "verify"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "257849678814626671772879863135859850558",
                "124386593663936172113173685244098185521",
                "162529091931910546808930903182153008454"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59643-9202726d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target":  {
            "file":  "pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPMessageInputStream.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "172557102128809386266827450075305921969",
                "42531372055468316586461977645059231492",
                "160647408479682087836198968712110396396",
                "86469570113435410839828717691358614367",
                "177008846472015520334544926763955714417",
                "82835921102860577221632520033368595867",
                "238170072923511013552432574084480307582",
                "170590701737993671665047275272717645692",
                "73771180015333184558221933947568112570",
                "235738781034188994572505567880883319758",
                "136869947080642571612808836682656351009",
                "311136713775573870709133661747432114881",
                "17962498063518198443482594504675445086",
                "137903700804039137170975108313969361104"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59643-cbebd152",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target":  {
            "file":  "pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPMessageProcessorTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "249351862657477541506197813181157570852",
            "length":  581
        },
        "id":  "CVE-2026-59643-f73d9bc1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b",
        "target":  {
            "file":  "pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPMessageProcessorTest.java",
            "function":  "performTestWith"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T10:26:51Z"