{"id":"CVE-2026-59643","title":"In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored","summary":"In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-347","CWE-390"],"vendor":"bouncycastle","product":"bc-java","affected":["bc-java < 1.85","bcpg-fips < 2.0.13"],"patched":["bc-java 1.85","bcpg-fips 2.0.13"],"published":"2026-08-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:02:52.073","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59643","references":[{"url":"https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059643","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59643","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59643.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59643"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510206"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59643"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59643"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00163,"epssPercentile":0.05968,"ingestedAt":"2026-08-03T01:21:07.842Z","slug":"CVE-2026-59643","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.\n\n## Affected\n\n- `bc-java < 1.85`\n- `bcpg-fips < 2.0.13`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `bc-java 1.85`\n- `bcpg-fips 2.0.13`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59643.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201835,"id":"CVE-2026-59643","ts":1789399743099,"field":"cvss","old":null,"new":"7.5"},{"seq":201834,"id":"CVE-2026-59643","ts":1789399743099,"field":"severity","old":"none","new":"high"},{"seq":200565,"id":"CVE-2026-59643","ts":1789397412193,"field":"cvss","old":"7.5","new":null},{"seq":200564,"id":"CVE-2026-59643","ts":1789397412193,"field":"severity","old":"high","new":"none"},{"seq":198482,"id":"CVE-2026-59643","ts":1789392001463,"field":"cvss","old":null,"new":"7.5"},{"seq":198481,"id":"CVE-2026-59643","ts":1789392001463,"field":"severity","old":"none","new":"high"},{"seq":196275,"id":"CVE-2026-59643","ts":1789383612074,"field":"cvss","old":"7.5","new":null},{"seq":196274,"id":"CVE-2026-59643","ts":1789383612074,"field":"severity","old":"high","new":"none"},{"seq":195204,"id":"CVE-2026-59643","ts":1789380497174,"field":"cvss","old":null,"new":"7.5"},{"seq":195203,"id":"CVE-2026-59643","ts":1789380497174,"field":"severity","old":"none","new":"high"},{"seq":193991,"id":"CVE-2026-59643","ts":1789378551965,"field":"cvss","old":"7.5","new":null},{"seq":193990,"id":"CVE-2026-59643","ts":1789378551965,"field":"severity","old":"high","new":"none"},{"seq":192778,"id":"CVE-2026-59643","ts":1789376426090,"field":"cvss","old":null,"new":"7.5"},{"seq":192777,"id":"CVE-2026-59643","ts":1789376426090,"field":"severity","old":"none","new":"high"},{"seq":191565,"id":"CVE-2026-59643","ts":1789373454884,"field":"cvss","old":"7.5","new":null},{"seq":191564,"id":"CVE-2026-59643","ts":1789373454884,"field":"severity","old":"high","new":"none"},{"seq":190350,"id":"CVE-2026-59643","ts":1789369346082,"field":"cvss","old":null,"new":"7.5"},{"seq":190349,"id":"CVE-2026-59643","ts":1789369346082,"field":"severity","old":"none","new":"high"},{"seq":189137,"id":"CVE-2026-59643","ts":1789368282961,"field":"cvss","old":"7.5","new":null},{"seq":189136,"id":"CVE-2026-59643","ts":1789368282961,"field":"severity","old":"high","new":"none"},{"seq":187920,"id":"CVE-2026-59643","ts":1789365161994,"field":"cvss","old":null,"new":"7.5"},{"seq":187919,"id":"CVE-2026-59643","ts":1789365161994,"field":"severity","old":"none","new":"high"},{"seq":186707,"id":"CVE-2026-59643","ts":1789363306387,"field":"cvss","old":"7.5","new":null},{"seq":186706,"id":"CVE-2026-59643","ts":1789363306387,"field":"severity","old":"high","new":"none"},{"seq":185493,"id":"CVE-2026-59643","ts":1789361123047,"field":"cvss","old":null,"new":"7.5"},{"seq":185492,"id":"CVE-2026-59643","ts":1789361123047,"field":"severity","old":"none","new":"high"},{"seq":184280,"id":"CVE-2026-59643","ts":1789358181389,"field":"cvss","old":"7.5","new":null},{"seq":184279,"id":"CVE-2026-59643","ts":1789358181389,"field":"severity","old":"high","new":"none"},{"seq":182531,"id":"CVE-2026-59643","ts":1789354238620,"field":"cvss","old":null,"new":"7.5"},{"seq":182530,"id":"CVE-2026-59643","ts":1789354238620,"field":"severity","old":"none","new":"high"},{"seq":181324,"id":"CVE-2026-59643","ts":1789353154193,"field":"cvss","old":"7.5","new":null},{"seq":181323,"id":"CVE-2026-59643","ts":1789353154193,"field":"severity","old":"high","new":"none"},{"seq":180117,"id":"CVE-2026-59643","ts":1789350187379,"field":"cvss","old":null,"new":"7.5"},{"seq":180116,"id":"CVE-2026-59643","ts":1789350187379,"field":"severity","old":"none","new":"high"},{"seq":178910,"id":"CVE-2026-59643","ts":1789348122959,"field":"cvss","old":"7.5","new":null},{"seq":178909,"id":"CVE-2026-59643","ts":1789348122959,"field":"severity","old":"high","new":"none"},{"seq":177703,"id":"CVE-2026-59643","ts":1789346293657,"field":"cvss","old":null,"new":"7.5"},{"seq":177702,"id":"CVE-2026-59643","ts":1789346293657,"field":"severity","old":"none","new":"high"},{"seq":176496,"id":"CVE-2026-59643","ts":1789343044501,"field":"cvss","old":"7.5","new":null},{"seq":176495,"id":"CVE-2026-59643","ts":1789343044501,"field":"severity","old":"high","new":"none"},{"seq":174613,"id":"CVE-2026-59643","ts":1789334801262,"field":"cvss","old":null,"new":"7.5"},{"seq":174612,"id":"CVE-2026-59643","ts":1789334801262,"field":"severity","old":"none","new":"high"},{"seq":173408,"id":"CVE-2026-59643","ts":1789333530583,"field":"cvss","old":"7.5","new":null},{"seq":173407,"id":"CVE-2026-59643","ts":1789333530583,"field":"severity","old":"high","new":"none"},{"seq":172222,"id":"CVE-2026-59643","ts":1789331030687,"field":"cvss","old":null,"new":"7.5"},{"seq":172221,"id":"CVE-2026-59643","ts":1789331030687,"field":"severity","old":"none","new":"high"},{"seq":171036,"id":"CVE-2026-59643","ts":1789328646543,"field":"cvss","old":"7.5","new":null},{"seq":171035,"id":"CVE-2026-59643","ts":1789328646543,"field":"severity","old":"high","new":"none"},{"seq":169831,"id":"CVE-2026-59643","ts":1789327070029,"field":"cvss","old":null,"new":"7.5"},{"seq":169830,"id":"CVE-2026-59643","ts":1789327070029,"field":"severity","old":"none","new":"high"}]}