CVE-2026-59642

🗓️ 03 Aug 2026 00:53:28Reported by bcorgType

AuthenticatedData content not bound to MAC when authentication attributes are present in Bouncy Castle Java releases.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Configuration Manager is affected by multiple Bouncy Castle vulnerabilities that could cause denial of service, resource exhaustion, cryptographic verification bypass, or other security impacts.	3 Sep 202613:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	27 Aug 202606:11	–	ibm
ATTACKERKB	CVE-2026-59642	3 Aug 202600:53	–	attackerkb
Atlassian	Cryptographic Failure org.bouncycastle:bcpkix-jdk18on Dependency in Bamboo Data Center	8 Aug 202617:30	–	atlassian
Cvelist	CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present	3 Aug 202600:53	–	cvelist
Debian CVE	CVE-2026-59642	3 Aug 202600:53	–	debiancve
EUVD	EUVD-2026-52032	3 Aug 202600:53	–	euvd
NCSC	Vulnerabilities present in Atlassian products	24 Aug 202609:52	–	ncsc
NVD	CVE-2026-59642	3 Aug 202601:16	–	nvd

NVD

Node

bouncycastle bc-javaRange<1.85

bouncycastle bcpkix-fipsRange<1.0.12

bouncycastle bcpkix-fipsRange2.0.7–2.0.12

bouncycastle bcpkix-fipsRange2.1.8–2.1.12

bouncycastle bouncy_castle_for_java_ltsRange≤2.73.11

[
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-JAVA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
    "packageName": "bcpkix",
    "repo": "https://github.com/bcgit/bc-java",
    "packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
    "modules": [
      "pkix"
    ],
    "programFiles": [
      "RecipientInformation"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.85",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-LTS-JAVA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
    "packageName": "bcpkix-lts8on",
    "repo": "https://github.com/bcgit/bc-lts-java",
    "packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
    "modules": [
      "pkix"
    ],
    "programFiles": [
      "RecipientInformation"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "2.73.0",
        "lessThan": "2.73.12",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Legion of the Bouncy Castle Inc.",
    "product": "BC-FJA",
    "platforms": [
      "all"
    ],
    "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
    "packageName": "bcpkix-fips",
    "packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "1.0.12",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.12",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "2.1.0",
        "lessThan": "2.1.12",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642

28 Aug 2026 18:12Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

CVSS 48.7

EPSS0.00147

SSVC

CWE-354