PT-2026-33031 · Bouncy Castle · Bcpkix Fips+1

Osidb Bzimport · CVE-2026-5588 · Published 2026-04-15 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BC-JAVA versions 1.49 through 1.83 BCPKIX-FIPS versions 2.0.6 through 2.0.10 BCPKIX-FIPS versions 2.1.7 through 2.1.10

Description The PKIX draft CompositeVerifier accepts an empty signature sequence as valid. This issue is associated with the program file JcaContentVerifierProviderBuilder.Java and involves the use of a broken or risky cryptographic algorithm within the pkix modules.

Recommendations Update BC-JAVA to version 1.84 or later. Update BCPKIX-FIPS versions 2.0.6 through 2.0.10 to version 2.0.11 or later. Update BCPKIX-FIPS versions 2.1.7 through 2.1.10 to version 2.1.11 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-347

CWE-327

Related Identifiers

CLEANSTART-2026-AV84730

CLEANSTART-2026-DY69070

CLEANSTART-2026-GX01236

CLEANSTART-2026-IS05941

CLEANSTART-2026-JU62349

CLEANSTART-2026-KP10590

CLEANSTART-2026-PK73499

CLEANSTART-2026-PO27799

CLEANSTART-2026-RU36468

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SR31778

CLEANSTART-2026-SV95049

CLEANSTART-2026-TK07726

CLEANSTART-2026-VJ37814

CLEANSTART-2026-VN28553

CLEANSTART-2026-WK99982

CVE-2026-5588

GHSA-WG6Q-6289-32HP

OPENSUSE-SU-2026:10571-1

OPENSUSE-SU-2026:20627-1

SUSE-SU-2026:1639-1

SUSE-SU-2026:21404-1

Affected Products

Bc-Java

Bcpkix Fips

References · 333

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5588.json · Exploit
• https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48924 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22569 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42403 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22732 · Security Note
• https://access.redhat.com/errata/RHSA-2026:14276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53864 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42198 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35554 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12158 · Security Note