Skip to content
CVE IDCVE-2026-5588GitHub advisory IDGHSA-wg6q-6289-32hp

Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

CVE-2026-5588 (GitHub advisory GHSA-wg6q-6289-32hp) is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3, classed as Use of a Broken or Risky Cryptographic Algorithm (CWE-327), in 7 packages, including org.bouncycastle:bcpkix-jdk18on (Maven) and org.bouncycastle:bcpkix-jdk15to18 (Maven). It is fixed in 1.84.

Medium6.3Fix availableGitHub reviewed

Published 15 Apr 2026Updated 18 Sept 2026

6.3MediumCVSS 4.0
CVE ID
CVE-2026-5588
GHSA ID
GHSA-wg6q-6289-32hp
EPSS
0.68%higher than 50% of CVEs
Weaknesses (CWE)
  • CWE-327Use of a Broken or Risky Cryptographic Algorithm
  • CWE-347Improper Verification of Cryptographic Signature
KEV status
Not in KEV
Published
15 Apr 2026
Updated
18 Sept 2026
Ecosystem
  • Maven
Assigned by (CNA)
bcorg

Summary

Source: OSV (GitHub advisory)

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

This issue affects BC-JAVA: from 1.49 before 1.84.

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green

Medium6.3Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
Present
Privileges Required PR
None
User Interaction UI
None
Confidentiality (Vulnerable System) VC
Low
Integrity (Vulnerable System) VI
None
Availability (Vulnerable System) VA
None
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None
Provider Urgency U
Green

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
yes
Attackers can automate this at scale
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • org.bouncycastle:bcpkix-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcpkix-jdk18on
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 17 listed versions
    • 1.71
    • 1.71.1
    • 1.72
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
    • 1.79
    • 1.80
  • org.bouncycastle:bcpkix-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcpkix-jdk15to18
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 22 listed versions
    • 1.63
    • 1.64
    • 1.65
    • 1.66
    • 1.67
    • 1.68
    • 1.69
    • 1.70
    • 1.71
    • 1.72
    • 1.73
    • 1.74
  • org.bouncycastle:bcpkix-jdk15on
    Maven
    pkg:maven/org.bouncycastle/bcpkix-jdk15on
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 22 listed versions
    • 1.49
    • 1.50
    • 1.51
    • 1.52
    • 1.53
    • 1.54
    • 1.55
    • 1.56
    • 1.57
    • 1.58
    • 1.59
    • 1.60
  • org.bouncycastle:bcpkix-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcpkix-jdk14
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 34 listed versions
    • 1.49
    • 1.50
    • 1.51
    • 1.53
    • 1.54
    • 1.55
    • 1.56
    • 1.57
    • 1.58
    • 1.59
    • 1.60
    • 1.61
  • org.bouncycastle:bcpkix-debug-jdk18on
    Maven
    pkg:maven/org.bouncycastle/bcpkix-debug-jdk18on
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 11 listed versions
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
    • 1.79
    • 1.81
    • 1.82
    • 1.83
  • org.bouncycastle:bcpkix-debug-jdk15to18
    Maven
    pkg:maven/org.bouncycastle/bcpkix-debug-jdk15to18
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 12 listed versions
    • 1.73
    • 1.74
    • 1.75
    • 1.76
    • 1.77
    • 1.78
    • 1.78.1
    • 1.79
    • 1.80
    • 1.81
    • 1.82
    • 1.83
  • org.bouncycastle:bcpkix-debug-jdk14
    Maven
    pkg:maven/org.bouncycastle/bcpkix-debug-jdk14
    Affected versions
    >= 1.49, < 1.84
    Fixed in
    1.84
    Show 3 listed versions
    • 1.81
    • 1.82
    • 1.83

Fix

Source: OSV (GitHub advisory)

Fix available

  • org.bouncycastle:bcpkix-jdk18on: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-jdk15to18: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-jdk15on: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-jdk14: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-debug-jdk18on: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-debug-jdk15to18: upgrade to 1.84 or later
  • org.bouncycastle:bcpkix-debug-jdk14: upgrade to 1.84 or later

Patch commits

  • 656bae0Patch commitgithub.com/bcgit/bc-java

    ensured generic composite always checks at least one signature. Added additional new composite test.

    +147 −34 across 2 files

    • pkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentVerifierProviderBuilder.java+4 −1
    • pkix/src/test/java/org/bouncycastle/cert/cmp/test/AllTests.java+143 −33

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • d3fbd45Release commit1.80.2github.com/bcgit/bc-java
  • dd0e7f8Release commit1.81.1github.com/bcgit/bc-java
  • d716d77Release commit1.84github.com/bcgit/bc-java

Vulnerability intelligence

References

Credits

  • Nicholas Carlini using Claude, Anthropicfinder

Questions about CVE-2026-5588

What is the GHSA ID for CVE-2026-5588?
GitHub tracks CVE-2026-5588 as GHSA-wg6q-6289-32hp.
What is the CVSS score of CVE-2026-5588?
CVE-2026-5588 has a CVSS 4.0 base score of 6.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green. Other published scores: CVSS 3.1 7.5.
Which versions are affected by CVE-2026-5588?
org.bouncycastle:bcpkix-jdk18on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk15to18 (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk15on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk14 (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-debug-jdk18on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): >= 1.49, < 1.84. 1 more packages are listed on the page.
How do I fix CVE-2026-5588?
Upgrade to 1.84 or later. The fix is in commit 656bae0.
What is the Package URL (PURL) for CVE-2026-5588?
The affected packages' PURLs are pkg:maven/org.bouncycastle/bcpkix-jdk18on, pkg:maven/org.bouncycastle/bcpkix-jdk15to18, pkg:maven/org.bouncycastle/bcpkix-jdk15on, pkg:maven/org.bouncycastle/bcpkix-jdk14, pkg:maven/org.bouncycastle/bcpkix-debug-jdk18on and pkg:maven/org.bouncycastle/bcpkix-debug-jdk15to18 and more.
Is CVE-2026-5588 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-5588. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 50% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 13:28 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.