CVE-2026-59643

CVE-2026-59643 affects Bouncy Castle for Java prior to 1.85 and BC-FJA prior to bcpg-fips 2.0.13, where OpenPGP inline-signature policy failures are silently ignored. This implies that inline-signature policy checks may not be enforced, potentially allowing signatures to bypass policy constraints...

CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.84.0-03, <=3.88.0-08) +109 more potentially affected by CVE-2026-59643 via org.bouncycastle:bcpg-jdk15to18 (>=1.81, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.81, =3.84.0-03, =3.84.0-03, =3.84.0-03, =3.84.0-03, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.89.0-09, =3.92.3-01 and more S...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.igniterealtime.smack:smack-android (>=4.5.0-alpha2, <=4.5.0-beta2) +199 more potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-jdk15to18 (>=1.71, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.71, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-beta3, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.10.0 and more Source cves: CVE-2026-59648 Source advisory:...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59648 Source advisory: MEND:CVE-2026-59648...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59649 Source advisory: MEND:CVE-2026-59649...

org.opensearch:opensearch-plugin-cli (>=2.17.0, <=3.2.0) potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=2.0.9, <=2.0.11)

org.bouncycastle:bcpg-fips MAVEN version =2.0.9, =2.17.0, =3.2.0 Source cves: CVE-2026-59649 Source advisory: MEND:CVE-2026-59649...

org.opensearch:opensearch-plugin-cli (>=3.3.0, <=3.8.0), org.sonatype.nexus.api.extdirect:nexus-api-extdirect-common (>=3.81.0-08, <=3.88.0-08) +110 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (2.1.11)

org.bouncycastle:bcpg-fips MAVEN version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - org.opensearch:opensearch-plugin-cli =3.3.0, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.81.0-08, =3.89.0-09,...

CVE-2026-59643: Improper Verification of Cryptographic Signature

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

org.bouncycastle:bcmail-jdk14 (>=1.73, <=1.77), org.bouncycastle:bcpg-jdk14 (>=1.73, <=1.77) +11 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-jdk14 (>=1.73, <=1.77)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.73, =1.73, =1.73, =1.73, =1.73, =1.73, =0.2.5, =1.0.1-rc.1, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.3.2 Source cves: CVE-2024-14041 Source advisory: MEND:CVE-2024-14041...

DoS (Denial of Service) org.bouncycastle:bcpg-lts8on Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

org.bouncycastle:bcmail-jdk14 (1.81), org.bouncycastle:bcpg-jdk14 (1.81) +3 more potentially affected by CVE-2026-5598 via org.bouncycastle:bcprov-jdk14 (1.81)

org.bouncycastle:bcprov-jdk14 MAVEN version 1.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk14 and may be impacted: - org.bouncycastle:bcmail-jdk14 1.81 - org.bouncycastle:bcpg-jdk14 1.81 - org.bouncycastle:bcpkix-jdk14...

org.bouncycastle:bcmail-jdk14 (1.81), org.bouncycastle:bcpg-jdk14 (1.81) +3 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-jdk14 (1.81)

org.bouncycastle:bcprov-jdk14 MAVEN version 1.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk14 and may be impacted: - org.bouncycastle:bcmail-jdk14 1.81 - org.bouncycastle:bcpg-jdk14 1.81 - org.bouncycastle:bcpkix-jdk14...

org.bouncycastle:bcjmail-debug-jdk18on (1.81), org.bouncycastle:bcmail-debug-jdk18on (1.81) +5 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-debug-jdk18on (1.81)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version 1.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-debug-jdk18on and may be impacted: - org.bouncycastle:bcjmail-debug-jdk18on 1.81 - org.bouncycastle:bcmail-debug-jdk18on 1....

org.bouncycastle:bcjmail-debug-jdk15to18 (1.81), org.bouncycastle:bcmail-debug-jdk15to18 (1.81) +4 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-debug-jdk15to18 (1.81)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version 1.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-debug-jdk15to18 and may be impacted: - org.bouncycastle:bcjmail-debug-jdk15to18 1.81 -...

org.bouncycastle:bcmail-debug-jdk14 (1.81), org.bouncycastle:bcpg-debug-jdk14 (1.81) +3 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-debug-jdk14 (1.81)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version 1.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-debug-jdk14 and may be impacted: - org.bouncycastle:bcmail-debug-jdk14 1.81 - org.bouncycastle:bcpg-debug-jdk14 1.81 -...

org.bouncycastle:bcmail-debug-jdk14 (>=1.82, <=1.83), org.bouncycastle:bcpg-debug-jdk14 (>=1.82, <=1.83) +3 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-debug-jdk14 (>=1.82, <=1.83)

org.bouncycastle:bcprov-debug-jdk14 MAVEN version =1.82, =1.82, =1.82, =1.82, =1.82, =1.82, =1.83 Source cves: CVE-2025-14813 Source advisory: GHSA-574F-3G2M-X479...

org.bouncycastle:bcjmail-debug-jdk18on (>=1.82, <=1.83), org.bouncycastle:bcmail-debug-jdk18on (>=1.82, <=1.83) +5 more potentially affected by CVE-2025-14813 via org.bouncycastle:bcprov-debug-jdk18on (>=1.82, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.82, =1.82, =1.82, =1.82, =1.82, =1.82, =1.82, =1.82, =1.83 Source cves: CVE-2025-14813 Source advisory: GHSA-574F-3G2M-X479...