SUSE CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in OpenPGPCertificate.getCertificationBy and getDelegationBy in the OpenPGP certificate API. An attacker can have a third-party certification or direct-key trust delegation accepted as if it were issued by the...

CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

CVE-2026-71886

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...

CVE-2026-71886 OpenPGP certification accepted from a subkey without certification authority

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...

CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

PT-2026-104560

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description The high-level OpenPGP API incorrectly accepts data signatures from a signing subkey when the Subkey Binding signature lacks an embedded Primary Key Binding cross-certification signatur...

Linux Distros Unpatched Vulnerability : CVE-2026-71887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no...