PatchSiren cyber security CVE debrief

CVE-2026-5588 Legion of the Bouncy Castle Inc. CVE debrief

A Use of a Broken or Risky Cryptographic Algorithm vulnerability (CWE-327) exists in Legion of the Bouncy Castle's BC-JAVA, BCPKIX-FIPS, and BCPIX-LTS libraries. The vulnerability affects the PKIX modules and is associated with the JcaContentVerifierProviderBuilder and JcaContentVerfierProviderBuilder Java files. The issue stems from improper cryptographic algorithm selection that could allow attackers to bypass signature verification or forge signatures in affected certificate processing operations.

Vendor: Legion of the Bouncy Castle Inc.
Product: BC-JAVA
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-15
Original CVE updated: 2026-09-18
Advisory published: 2026-04-15
Advisory updated: 2026-09-18

Who should care

Organizations using Bouncy Castle libraries for certificate processing, PKI infrastructure, or cryptographic operations in Java applications should prioritize patching. This particularly affects enterprises running certificate authority software, TLS implementations, or document signing systems built on Bouncy Castle components.

Technical summary

The vulnerability exists in Bouncy Castle's PKIX module implementations where broken or risky cryptographic algorithms may be used during certificate signature verification. Affected classes include JcaContentVerifierProviderBuilder and JcaContentVerfierProviderBuilder. The flaw could potentially allow signature forgery or verification bypass in certificate chain validation. Multiple product lines are affected: BC-JAVA (versions 1.67-1.80.1, 1.81, 1.82-1.83), BCPKIX-FIPS (versions 2.0.6-2.0.10, 2.1.7-2.1.10), and BCPIX-LTS (versions 2.73.7-2.73.10). The vendor has released patched versions and published detailed remediation guidance.

Defensive priority

medium

Recommended defensive actions

Upgrade BC-JAVA to version 1.80.2, 1.81.1, or 1.84 or later depending on your current branch
Upgrade BCPKIX-FIPS to version 2.0.11 or 2.1.11 or later depending on your current branch
Upgrade BCPIX-LTS to version 2.73.11 or later
Review applications using Bouncy Castle for certificate verification operations
Audit certificate validation logic in affected JcaContentVerifierProviderBuilder implementations
Monitor vendor security advisories for additional guidance

Evidence notes

The vulnerability was published on 2026-04-15 and last modified on 2026-05-19. The NVD entry shows status 'Awaiting Analysis' with CVSS 4.0 vector indicating network attack vector, low attack complexity, and partial attack timing requirements. The vendor has published a dedicated CVE wiki page and committed a fix.

Sources and references

Verified primary and authoritative sources

CVE-2026-5588 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-5588

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-5588 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5588

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057

91579145-5d7b-4cc5-b925-a0262ff19630
Source reference
Unverified legacy reference

URL: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588

91579145-5d7b-4cc5-b925-a0262ff19630

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.