CVE-2026-71888

The Bouncy Castle for Java library (versions before 1.86 ) contains a vulnerability in the streaming CMS AuthenticatedData parser. The parser incorrectly handles messages where the digestAlgorithm and authAttrs fields disagree on the presence of authenticated attributes. Because the parser makes ...