ROOT-APP-MAVEN-CVE-2025-8916 CVE-2025-8916 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2025-8916 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-5588 CVE-2026-5588 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2026-5588 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536979...

cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3), com.blitz-chain:blitz-chain (1.2) +80 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-jdk14 (>=1.47, <=1.85)

org.bouncycastle:bcpkix-jdk14 MAVEN version =1.47, =4.2.1, =9.1.20, =2.0, =2.0, =2.0, =0.1.1, =ibanity-java-1.1.20180605145337, =2.2, =2.0.1, =7.0-rc2, =1.5, =12.3, =22.2.3 and more Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536975...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.github.manosbatsis.corbeans:corbeans-corda-webserver (>=0.26, <=0.30) +62 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.12)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =0.26, =0.26, =0.26, =0.26, =0.0.9-snapshot, =4.1.1-patch-01, =0.0.9-snapshot, =4.12, =4.12, =7.0, =7.5 and more Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536978...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-71888 Source advisor...

app.cash.trifle:common (>=0.2.9, <=0.2.10), app.cash.trifle:jvm (>=0.1.0, <=0.2.10) +1030 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-jdk15to18 (>=1.63, <=1.85)

org.bouncycastle:bcpkix-jdk15to18 MAVEN version =1.63, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =3.5.0.0, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =3.0.8 and more Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536976...

org.bouncycastle:bcjmail-debug-jdk18on (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk18on (>=1.81, <=1.85) +1 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-debug-jdk18on (>=1.81, <=1.85)

org.bouncycastle:bcpkix-debug-jdk18on MAVEN version =1.81, =1.81, =1.81, =1.81, =1.85 Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536974...

org.bouncycastle:bcmail-debug-jdk14 (>=1.81, <=1.85) potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-debug-jdk14 (>=1.81, <=1.85)

org.bouncycastle:bcpkix-debug-jdk14 MAVEN version =1.81, =1.81, =1.85 Source cves: CVE-2026-71888 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536972...

com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-snapshot-a030c50, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-snapshot-a030c50, <=3.0.14.1) +11 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=1.0.5, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-snapshot-a030c50, =3.0.7.0-snapshot-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =master-rc-daily, =master-rc-daily, =3.13.14, =3.0.0, =19.0.0, =25.0.6 Source cves: CVE-2026-71889 Source advisory:...

cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3), com.blitz-chain:blitz-chain (1.2) +80 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-jdk14 (>=1.47, <=1.85)

org.bouncycastle:bcpkix-jdk14 MAVEN version =1.47, =4.2.1, =9.1.20, =2.0, =2.0, =2.0, =0.1.1, =ibanity-java-1.1.20180605145337, =2.2, =2.0.1, =7.0-rc2, =1.5, =12.3, =22.2.3 and more Source cves: CVE-2026-71889 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536906...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-debug-jdk15to18 (>=1.81, <=1.85)

org.bouncycastle:bcpkix-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.85 Source cves: CVE-2026-71889 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536904...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-core (>=0.4.0, <=0.9.8) +11056 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.9.2 and more Source cves: CVE-2026-71889 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536908...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the CMSAuthenticatedDataParser process. An attacker can cause unauthorized attribute injection by crafting a message where the digestAlgorithm field is absent but authAttrs is present,...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-core (>=0.4.0, <=0.9.8) +8775 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-jdk18on (>=1.78, <=1.85)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.78, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =3.10.0.5, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536916...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-debug-jdk15to18 (>=1.81, <=1.85)

org.bouncycastle:bcpkix-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.85 Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536912...

org.bouncycastle:bcjmail-debug-jdk18on (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk18on (>=1.81, <=1.85) +1 more potentially affected by CVE-2026-71892 via org.bouncycastle:bcpkix-debug-jdk18on (>=1.81, <=1.85)

org.bouncycastle:bcpkix-debug-jdk18on MAVEN version =1.81, =1.81, =1.81, =1.81, =1.85 Source cves: CVE-2026-71892 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536913...