{"id":"CVE-2026-59639","title":"In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers","summary":"In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0…","severity":"high","cwe":["CWE-347"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59639","references":[{"url":"https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59639","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59639.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59639"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510197"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59639"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59639"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.726Z","epss":0.00163,"epssPercentile":0.05968,"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","affected":["ceph_storage 9","enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","slug":"CVE-2026-59639","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Ceph Storage 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat Ceph Storage 9, Red Hat JBoss Enterprise Application Platform 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59639.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201831,"id":"CVE-2026-59639","ts":1789399743068,"field":"cvss","old":null,"new":"7.5"},{"seq":201830,"id":"CVE-2026-59639","ts":1789399743068,"field":"severity","old":"none","new":"high"},{"seq":200561,"id":"CVE-2026-59639","ts":1789397412165,"field":"cvss","old":"7.5","new":null},{"seq":200560,"id":"CVE-2026-59639","ts":1789397412165,"field":"severity","old":"high","new":"none"},{"seq":198478,"id":"CVE-2026-59639","ts":1789392001437,"field":"cvss","old":null,"new":"7.5"},{"seq":198477,"id":"CVE-2026-59639","ts":1789392001437,"field":"severity","old":"none","new":"high"},{"seq":196271,"id":"CVE-2026-59639","ts":1789383612046,"field":"cvss","old":"7.5","new":null},{"seq":196270,"id":"CVE-2026-59639","ts":1789383612046,"field":"severity","old":"high","new":"none"},{"seq":195200,"id":"CVE-2026-59639","ts":1789380497149,"field":"cvss","old":null,"new":"7.5"},{"seq":195199,"id":"CVE-2026-59639","ts":1789380497149,"field":"severity","old":"none","new":"high"},{"seq":193987,"id":"CVE-2026-59639","ts":1789378551937,"field":"cvss","old":"7.5","new":null},{"seq":193986,"id":"CVE-2026-59639","ts":1789378551937,"field":"severity","old":"high","new":"none"},{"seq":192774,"id":"CVE-2026-59639","ts":1789376426065,"field":"cvss","old":null,"new":"7.5"},{"seq":192773,"id":"CVE-2026-59639","ts":1789376426065,"field":"severity","old":"none","new":"high"},{"seq":191561,"id":"CVE-2026-59639","ts":1789373454856,"field":"cvss","old":"7.5","new":null},{"seq":191560,"id":"CVE-2026-59639","ts":1789373454856,"field":"severity","old":"high","new":"none"},{"seq":190346,"id":"CVE-2026-59639","ts":1789369345500,"field":"cvss","old":null,"new":"7.5"},{"seq":190345,"id":"CVE-2026-59639","ts":1789369345500,"field":"severity","old":"none","new":"high"},{"seq":189133,"id":"CVE-2026-59639","ts":1789368282935,"field":"cvss","old":"7.5","new":null},{"seq":189132,"id":"CVE-2026-59639","ts":1789368282935,"field":"severity","old":"high","new":"none"},{"seq":187916,"id":"CVE-2026-59639","ts":1789365161969,"field":"cvss","old":null,"new":"7.5"},{"seq":187915,"id":"CVE-2026-59639","ts":1789365161969,"field":"severity","old":"none","new":"high"},{"seq":186703,"id":"CVE-2026-59639","ts":1789363306357,"field":"cvss","old":"7.5","new":null},{"seq":186702,"id":"CVE-2026-59639","ts":1789363306357,"field":"severity","old":"high","new":"none"},{"seq":185489,"id":"CVE-2026-59639","ts":1789361123021,"field":"cvss","old":null,"new":"7.5"},{"seq":185488,"id":"CVE-2026-59639","ts":1789361123021,"field":"severity","old":"none","new":"high"},{"seq":184276,"id":"CVE-2026-59639","ts":1789358181361,"field":"cvss","old":"7.5","new":null},{"seq":184275,"id":"CVE-2026-59639","ts":1789358181361,"field":"severity","old":"high","new":"none"},{"seq":182527,"id":"CVE-2026-59639","ts":1789354238593,"field":"cvss","old":null,"new":"7.5"},{"seq":182526,"id":"CVE-2026-59639","ts":1789354238593,"field":"severity","old":"none","new":"high"},{"seq":181320,"id":"CVE-2026-59639","ts":1789353154087,"field":"cvss","old":"7.5","new":null},{"seq":181319,"id":"CVE-2026-59639","ts":1789353154087,"field":"severity","old":"high","new":"none"},{"seq":180113,"id":"CVE-2026-59639","ts":1789350187349,"field":"cvss","old":null,"new":"7.5"},{"seq":180112,"id":"CVE-2026-59639","ts":1789350187349,"field":"severity","old":"none","new":"high"},{"seq":178906,"id":"CVE-2026-59639","ts":1789348122933,"field":"cvss","old":"7.5","new":null},{"seq":178905,"id":"CVE-2026-59639","ts":1789348122933,"field":"severity","old":"high","new":"none"},{"seq":177699,"id":"CVE-2026-59639","ts":1789346293630,"field":"cvss","old":null,"new":"7.5"},{"seq":177698,"id":"CVE-2026-59639","ts":1789346293630,"field":"severity","old":"none","new":"high"},{"seq":176492,"id":"CVE-2026-59639","ts":1789343043884,"field":"cvss","old":"7.5","new":null},{"seq":176491,"id":"CVE-2026-59639","ts":1789343043884,"field":"severity","old":"high","new":"none"},{"seq":174609,"id":"CVE-2026-59639","ts":1789334801236,"field":"cvss","old":null,"new":"7.5"},{"seq":174608,"id":"CVE-2026-59639","ts":1789334801236,"field":"severity","old":"none","new":"high"},{"seq":173404,"id":"CVE-2026-59639","ts":1789333529926,"field":"cvss","old":"7.5","new":null},{"seq":173403,"id":"CVE-2026-59639","ts":1789333529926,"field":"severity","old":"high","new":"none"},{"seq":172218,"id":"CVE-2026-59639","ts":1789331030662,"field":"cvss","old":null,"new":"7.5"},{"seq":172217,"id":"CVE-2026-59639","ts":1789331030662,"field":"severity","old":"none","new":"high"},{"seq":171032,"id":"CVE-2026-59639","ts":1789328646511,"field":"cvss","old":"7.5","new":null},{"seq":171031,"id":"CVE-2026-59639","ts":1789328646511,"field":"severity","old":"high","new":"none"},{"seq":169827,"id":"CVE-2026-59639","ts":1789327070003,"field":"cvss","old":null,"new":"7.5"},{"seq":169826,"id":"CVE-2026-59639","ts":1789327070003,"field":"severity","old":"none","new":"high"}]}