# CVE-2026-5588: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules > CVE-2026-5588 (GitHub advisory GHSA-wg6q-6289-32hp) is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3, classed as Use of a Broken or Risky Cryptographic Algorithm (CWE-327), in 7 packages, including org.bouncycastle:bcpkix-jdk18on (Maven) and org.bouncycastle:bcpkix-jdk15to18 (Maven). It is fixed in 1.84. Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-5588 | Field | Value | | --- | --- | | CVE | CVE-2026-5588 | | GHSA | GHSA-wg6q-6289-32hp | | Severity | Medium | | CVSS 4.0 | 6.3 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green` (GitHub Advisory Database) | | CVSS 4.0 | 6.3 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber` (CVE.org) | | CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` (CVE.org) | | CWE | CWE-327 Use of a Broken or Risky Cryptographic Algorithm; CWE-347 Improper Verification of Cryptographic Signature | | EPSS | 0.68% (higher than 50% of CVEs) | | CISA KEV | Not listed | | SSVC | exploitation none, automatable yes, technical impact partial | | Published | 15 Apr 2026 | | Modified | 18 Sept 2026 | ## Description : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84. ## Affected packages | Package | Ecosystem | PURL | Vulnerable versions | Fixed in | | --- | --- | --- | --- | --- | | org.bouncycastle:bcpkix-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk18on` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk15to18` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-jdk15on | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk15on` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcpkix-jdk14` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-debug-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcpkix-debug-jdk18on` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-debug-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcpkix-debug-jdk15to18` | >= 1.49, < 1.84 | 1.84 | | org.bouncycastle:bcpkix-debug-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcpkix-debug-jdk14` | >= 1.49, < 1.84 | 1.84 | ## Fix commits - Patch: https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057 - Release: https://github.com/bcgit/bc-java/commit/d3fbd45fd5e27fbc3a69b8ab150619f0dc8a6a44 (1.80.2) - Release: https://github.com/bcgit/bc-java/commit/dd0e7f83eef6b5d157139c9da21852d44bfcef71 (1.81.1) - Release: https://github.com/bcgit/bc-java/commit/d716d7716a452bad283323aefd88ff21eba8deef (1.84) ## Questions **What is the GHSA ID for CVE-2026-5588?** GitHub tracks CVE-2026-5588 as GHSA-wg6q-6289-32hp. **What is the CVSS score of CVE-2026-5588?** CVE-2026-5588 has a CVSS 4.0 base score of 6.3 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green. Other published scores: CVSS 3.1 7.5. **Which versions are affected by CVE-2026-5588?** org.bouncycastle:bcpkix-jdk18on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk15to18 (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk15on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-jdk14 (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-debug-jdk18on (Maven): >= 1.49, < 1.84. org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): >= 1.49, < 1.84. 1 more packages are listed on the page. **How do I fix CVE-2026-5588?** Upgrade to 1.84 or later. The fix is in commit 656bae0. **What is the Package URL (PURL) for CVE-2026-5588?** The affected packages' PURLs are pkg:maven/org.bouncycastle/bcpkix-jdk18on, pkg:maven/org.bouncycastle/bcpkix-jdk15to18, pkg:maven/org.bouncycastle/bcpkix-jdk15on, pkg:maven/org.bouncycastle/bcpkix-jdk14, pkg:maven/org.bouncycastle/bcpkix-debug-jdk18on and pkg:maven/org.bouncycastle/bcpkix-debug-jdk15to18 and more. **Is CVE-2026-5588 exploited in the wild?** CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-5588. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 50% of CVEs. ## References - https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057 (fix) - https://nvd.nist.gov/vuln/detail/CVE-2026-5588 (advisory) - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588 (advisory) - https://access.redhat.com/errata/RHSA-2026:11720 (advisory) - https://access.redhat.com/errata/RHSA-2026:11721 (advisory) - https://access.redhat.com/errata/RHSA-2026:13631 (advisory) - https://access.redhat.com/errata/RHSA-2026:14272 (advisory) - https://access.redhat.com/errata/RHSA-2026:14276 (advisory) - https://access.redhat.com/errata/RHSA-2026:17668 (advisory) - https://access.redhat.com/errata/RHSA-2026:18054 (advisory) - https://access.redhat.com/errata/RHSA-2026:18055 (advisory) - https://access.redhat.com/errata/RHSA-2026:18059 (advisory) - https://access.redhat.com/errata/RHSA-2026:21772 (advisory) - https://access.redhat.com/errata/RHSA-2026:53644 (advisory) - https://access.redhat.com/errata/RHSA-2026:53645 (advisory) - https://access.redhat.com/errata/RHSA-2026:53646 (advisory) - https://access.redhat.com/errata/RHSA-2026:60239 (advisory) - https://access.redhat.com/errata/RHSA-2026:60246 (advisory) - https://access.redhat.com/errata/RHSA-2026:60247 (advisory) - https://access.redhat.com/errata/RHSA-2026:60248 (advisory) - https://access.redhat.com/errata/RHSA-2026:60249 (advisory) - https://access.redhat.com/errata/RHSA-2026:60250 (advisory) - https://access.redhat.com/errata/RHSA-2026:60251 (advisory) - https://access.redhat.com/errata/RHSA-2026:60252 (advisory) - https://access.redhat.com/errata/RHSA-2026:60254 (advisory) - https://access.redhat.com/errata/RHSA-2026:60256 (advisory) - https://access.redhat.com/errata/RHSA-2026:60259 (advisory) - https://access.redhat.com/errata/RHSA-2026:66488 (advisory) - https://access.redhat.com/security/cve/CVE-2026-5588 (advisory) - https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5588.json (advisory) - https://github.com/advisories/GHSA-wg6q-6289-32hp (advisory) - https://bugzilla.redhat.com/show_bug.cgi?id=2458634 (report) - https://github.com/bcgit/bc-java (package) - https://repo1.maven.org/maven2/org/bouncycastle/bcpkix-fips/ - https://repo1.maven.org/maven2/org/bouncycastle/bcpkix-lts8on/ - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json - https://www.bouncycastle.org/download/bouncy-castle-java-fips/ - https://www.bouncycastle.org/download/bouncy-castle-java-lts/ - https://www.bouncycastle.org/download/bouncy-castle-java/ --- Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-5588), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.