CVE-2026-71888

A flaw was found in Bouncy Castle. In its Cryptographic Message Syntax CMS streaming parser, messages with mismatched attribute and algorithm fields are improperly handled, allowing attributes to be returned as valid even though they were not protected by the Message Authentication Code MAC. A...