Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 14	bouncycastle	=1.80-3
debian 13	bouncycastle	=1.80-3
debian 11	bouncycastle	=1.68-2 \|\| =1.68-3 \|\| =1.68-4 \|\| =1.68-5 \|\| =1.69-1 \|\| =1.71-1 \|\| =1.72-1 \|\| =1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3

Aliases

1. CVE-2026-596412. NVD-2026-596413. OSV-DEBIAN-2026-596414. OSV-2026-596415. SECURITY-TRACKER-CVE-2026-59641

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.