DEBIAN-CVE-2026-59639
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-59639
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59639.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-59639
- Upstream
- Published
- 2026-08-03T01:16:43.700Z
- Modified
- 2026-08-05T08:47:39.458685489Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber CVSS Calculator
- Summary
- [none]
- Details
-
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
- References
Affected packages
Debian:11 / bouncycastle
Package
- Name
- bouncycastle
- Purl
- pkg:deb/debian/bouncycastle?arch=source&distro=bullseye
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:12 / bouncycastle
Package
- Name
- bouncycastle
- Purl
- pkg:deb/debian/bouncycastle?arch=source&distro=bookworm
Debian:13 / bouncycastle
Package
- Name
- bouncycastle
- Purl
- pkg:deb/debian/bouncycastle?arch=source&distro=trixie
Debian:14 / bouncycastle
Package
- Name
- bouncycastle
- Purl
- pkg:deb/debian/bouncycastle?arch=source&distro=forky