{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-59639","assignerOrgId":"91579145-5d7b-4cc5-b925-a0262ff19630","state":"PUBLISHED","assignerShortName":"bcorg","dateReserved":"2026-07-06T06:58:29.263Z","datePublished":"2026-08-03T00:56:24.394Z","dateUpdated":"2026-08-03T13:24:16.359Z"},"containers":{"cna":{"providerMetadata":{"orgId":"91579145-5d7b-4cc5-b925-a0262ff19630","shortName":"bcorg","dateUpdated":"2026-08-03T05:05:39.619Z"},"title":"CMS verifySignatures returns true for SignedData with zero signers","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-347","description":"CWE-347 Improper Verification of Cryptographic Signature","type":"CWE"}]}],"affected":[{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-JAVA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java/","packageName":"bcpkix","repo":"https://github.com/bcgit/bc-java","packageURL":"pkg:maven/org.bouncycastle/bcpkix-jdk18on","modules":["pkix"],"programFiles":["CMSSignedData"],"versions":[{"status":"affected","version":"0","lessThan":"1.85","versionType":"maven"}],"defaultStatus":"unaffected"},{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-LTS-JAVA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/","packageName":"bcpkix-lts8on","repo":"https://github.com/bcgit/bc-lts-java","packageURL":"pkg:maven/org.bouncycastle/bcpkix-lts8on","modules":["pkix"],"programFiles":["CMSSignedData"],"versions":[{"status":"affected","version":"2.73.0","lessThan":"2.73.12","versionType":"maven"}],"defaultStatus":"unaffected"},{"vendor":"Legion of the Bouncy Castle Inc.","product":"BC-FJA","platforms":["all"],"collectionURL":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/","packageName":"bcpkix-fips","packageURL":"pkg:maven/org.bouncycastle/bcpkix-fips","versions":[{"status":"affected","version":"1.0.0","lessThan":"1.0.12","versionType":"maven"},{"status":"affected","version":"2.0.0","lessThan":"2.0.12","versionType":"maven"},{"status":"affected","version":"2.1.0","lessThan":"2.1.12","versionType":"maven"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).</p>"}]}],"references":[{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639","tags":["vendor-advisory"]},{"url":"https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber"}}],"credits":[{"lang":"en","value":"Alex Gaynor in collaboration with Claude and Anthropic Research","type":"reporter"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"bc release-notes template"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-03T13:24:06.309527Z","id":"CVE-2026-59639","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T13:24:16.359Z"}}]}}