Skip to main content

Improper Validation of Integrity Check Value in org.bouncycastle:bcpkix-fips

CVE-2026-59642

  • org.bouncycastle:bcpkix-fips
  • org.bouncycastle:bcpkix-jdk18on
  • org.bouncycastle:bcpkix-lts8on
High
8.7/10

Summary

In Bouncy Castle for Java prior to 1.85, CMS AuthenticatedData content is not bound to the MAC when authAttrs are present. This issue also affects Bouncy Castle for Java LTS prior to 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) prior to bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-354 - Improper Validation of Integrity Check Value

The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References

Advisory Timeline

  • Published