bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

🗓️ 05 May 2026 07:56:59Reported by RedHatType

Bouncy Castle PKIX CompositeVerifier flaw accepts empty signature, enabling remote bypass of verification.

Reporter	Title	Published	Views	Family All 153
ibm	Security Bulletin: Due to use of bcpkix-jdk18on-1.81.jar, IBM Sterling Connect:Direct Web Services is affected by Use of a Broken or Risky Cryptographic Algorithm vulnerability.	4 Jun 202602:55	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
ibm	Security Bulletin: IBM® Db2® is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82.	23 Jun 202619:54	–	ibm
ibm	Security Bulletin: There is a vulnerability in bcpkix-jdk18on-1.81.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-5588)	29 May 202609:58	–	ibm
ibm	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Jun 202608:35	–	ibm
ibm	Security Bulletin: MongoDB Enterprised Advanced affected by: Use of a Broken or Risky Cryptographic Algorithm (CVE-2026-5588)	15 Jun 202622:18	–	ibm
ibm	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to the use of Bouncy Castle library (CVE-2023-33202, CVE-2025-8916, CVE-2026-5588, CVE-2025-14813, CVE-2026-5598, CVE-2026-0636)	19 Jun 202608:51	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle (CVE-2026-0636,CVE-2026-5598,CVE-2026-5588&CVE-2026-3505)	29 Jun 202608:48	–	ibm
ibm	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Bouncy Castle bcpkix (CVE-2026-5588)	24 Jun 202622:18	–	ibm
ibm	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	14 Jul 202619:42	–	ibm

Vulners

Node

AND

redhat apache_camel_quarkusRange<3.27

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-5588
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-5588
cve	www.cve.org/CVERecord

15 Jul 2026 15:21Current

5.8Medium risk

Vulners AI Score5.8

CVSS 46.3

CVSS 3.17.5

EPSS0.00392

SSVC

CWE-347