PT-2026-67235 · Legion Of The Bouncy Castle · Bc-Fja+2

CVE-2026-59642 · Publicado 2026-08-03 · Atualizado 2026-08-03

NVD

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

Exploit

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

CVE-2026-59642

Produtos afetados

Bc-Fja

Bc-Java

Bc-Lts-Java

Referências · 3

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642 · Exploit
• https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-59642 · Nota de Segurança