CVE-2026-59642 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Organizations using Bouncy Castle for Java, especially those with high-security requirements, should review their inventory and apply updates to prevent potential security risks. This includes organizations using Bouncy Castle for Java in their products or services, as well as those that rely on the library for cryptographic functions. The vulnerability could have a significant impact on organizations that do not apply updates, potentially leading to security breaches or other issues. Additionally, security teams and vulnerability management teams should be aware of the vulnerability and take steps to mitigate its impact. Operators of affected systems should also be aware of the potential risks and take steps to protect their systems. Platforms that rely on Bouncy Castle for Java should also be reviewed for potential vulnerabilities. Overall, any organization that uses or relies on Bouncy Castle for Java should take steps to address this vulnerability. This may involve reviewing and updating affected systems, as well as monitoring for potential security risks. By taking proactive steps, organizations can help prevent potential security breaches and ensure the integrity of their systems and data. It is also recommended that organizations verify their inventory for affected Bouncy Castle for Java versions and apply patches or updates for Bouncy Castle for Java LTS and FIPS versions as needed. This can help to minimize the risk of exploitation and ensure the continued security of their systems and data. Furthermore, organizations should consider implementing compensating controls for exposed systems while remediation is scheduled and verified. This can help to reduce the risk of exploitation and protect against potential security breaches. By taking a proactive and comprehensive approach to addressing this vulnerability, organizations can help to ensure the security and integrity of their systems and data. The vulnerability management team should track exceptions, retest remediated assets, and close the item only after evidence is documented. The security team should also review relevant monitoring, detection, and logs for exposed assets that need extra review. In

Technical summary

The vulnerability in Bouncy Castle for Java before 1.85 involves CMS AuthenticatedData content not being bound to MAC when authAttrs are present. This issue affects multiple versions of Bouncy Castle for Java, including LTS before 2.73.12 and FIPS versions before specific releases. The vulnerability could allow attackers to exploit the weakness in the cryptographic library, potentially leading to security risks. Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential security risks.

Defensive priority

Organizations using Bouncy Castle for Java should review their inventory and apply updates to prevent potential security risks.

Recommended defensive actions

• Review and update Bouncy Castle for Java to version 1.85 or later
• Verify inventory for affected Bouncy Castle for Java versions
• Apply patches or updates for Bouncy Castle for Java LTS and FIPS versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates that Bouncy Castle for Java before 1.85 has an issue with CMS AuthenticatedData content not bound to MAC when authAttrs are present. This affects Bouncy Castle for Java LTS before 2.73.12 and Bouncy Castle for Java FIPS (BC-FJA) before specific versions.

Official resources