What is GHSA-cfjh-c47f-gprf?

GHSA-cfjh-c47f-gprf is a security advisory published by GitHub Security Advisories with High severity. In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when...

Which CVE IDs does GHSA-cfjh-c47f-gprf cover?

GHSA-cfjh-c47f-gprf covers the following CVE IDs: CVE-2026-59642. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-cfjh-c47f-gprfHigh

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-59642 →

📋 Description

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-59642
https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7
https://github.com/bcgit/bc-java/wiki/CVE-2026-59642
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642
https://github.com/advisories/GHSA-cfjh-c47f-gprf