Fluid Attacks Database

Description

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	bouncycastle	=1.80-3 \|\| >=0 <1.86-1	1.86-1
rpm rhel9	jmc	-	-
maven	org.bouncycastle:bcpg-fips	>=2.0.12 <2.0.13	2.0.13
maven	org.bouncycastle:bcpg-jdk15to18	>=1.81.0 <1.85.0	1.85.0
maven	org.bouncycastle:bcpg-jdk18on	>=1.81.0 <1.85.0	1.85.0
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3 \|\| =1.86-1	-
debian 13	bouncycastle	=1.80-3 \|\| =1.86-1	-

Aliases

1. CVE-2026-596432. NVD-2026-596433. OSV-DEBIAN-2026-596434. OSV-2026-596435. GCVE-2026-596436. SECURITY-TRACKER-CVE-2026-596437. https://github.com/bcgit/bc-java/wiki/CVE-2026-59643

References

1. https://github.com/bcgit/bc-java/commit/d3f8cc408b4a36d28e5a410c93436fe3d0fe726b

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.