Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.bouncycastle/bcpkix-jdk15to18/CVE-2026-59642
Advisory ID gitlab/maven/org.bouncycastle/bcpkix-jdk15to18/CVE-2026-59642
Aliases CVE-2026-59642
Summary CMS AuthenticatedData content not bound to MAC when authAttrs present Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and MAC intact, and verification still succeeds.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-354 Improper Validation of Integrity Check Value
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcpkix-jdk15to18/CVE-2026-59642.yml
Reference id Reference type URL
2117f316a5a47308f3e569695a6592b16aac0dd7 Other https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7
CVE-2026-59642 https://github.com/bcgit/bc-java/wiki/CVE-2026-59642
CVE-2026-59642 https://nvd.nist.gov/vuln/detail/CVE-2026-59642
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcpkix-jdk15to18/CVE-2026-59642.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.