CVE-2026-71887 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for Java applications using Bouncy Castle for cryptographic operations, particularly those involving OpenPGP signatures, should assess exposure and verify if their systems are using affected versions of Bouncy Castle.

Why it matters

CVE-2026-71887 allows for misattribution of genuine signatures in Bouncy Castle for Java before version 1.86. Defenders should verify their exposure, assess the impact on their systems, and update to version 1.86 or later to prevent exploitation.

• Signature misattribution can lead to incorrect attribution of genuine signatures
• An attacker can make it appear as though a victim signed a message when in fact the attacker did
• No private key is recovered, and the signature must be one the grafted subkey actually made
• Verification of subkey binding signatures is necessary to prevent exploitation

Technical summary

The vulnerability exists in the high-level OpenPGP API of Bouncy Castle for Java before version 1.86. An attacker can exploit this by binding their own subkey to a victim's public signing subkey, allowing them to make it appear as though the victim signed a message when in fact the attacker did. This is due to improper handling of subkey binding signatures, specifically when the binding signature omits a Key Flags subpacket.

Defensive priority

High

Recommended defensive actions

• Review and update Bouncy Castle for Java to version 1.86 or later
• Implement additional verification checks for subkey binding signatures
• Monitor for suspicious signature activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in the high-level OpenPGP API of Bouncy Castle for Java. An attacker needs only the victim's public signing subkey to exploit this vulnerability. The low-level PGPSignature / PGPPublicKeyRing API is unaffected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.