What is GHSA-r3rc-x3pq-jmw7?

GHSA-r3rc-x3pq-jmw7 is a security advisory published by GitHub Security Advisories with High severity. In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero...

Which CVE IDs does GHSA-r3rc-x3pq-jmw7 cover?

GHSA-r3rc-x3pq-jmw7 covers the following CVE IDs: CVE-2026-59639. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-r3rc-x3pq-jmw7High

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero...

Vendor

GitHub Security Advisories

Published

August 3, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-59639 →

📋 Description

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-59639
https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0
https://github.com/bcgit/bc-java/wiki/CVE-2026-59639
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639
https://github.com/advisories/GHSA-r3rc-x3pq-jmw7