Skip to content
Fencer Vulns
high 7.5

CVE-2026-5588 json

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

published 2026-04-15 6 mo ago modified 2026-10-26 13 d ago also GHSA-wg6q-6289-32hp , EUVD-2026-22871

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).

This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.

This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

Patch / fix

  • maven org.bouncycastle:bcpkix-jdk18on 1.84
  • maven org.bouncycastle:bcpkix-jdk15to18 1.84
  • maven org.bouncycastle:bcpkix-jdk15on 1.84
  • maven org.bouncycastle:bcpkix-jdk14 1.84
  • maven org.bouncycastle:bcpkix-debug-jdk18on 1.84
  • maven org.bouncycastle:bcpkix-debug-jdk15to18 1.84
  • maven org.bouncycastle:bcpkix-debug-jdk14 1.84
  • Legion of the Bouncy Castle Inc. BC-JAVA 1.80.2, 1.81.1, 1.84
  • Legion of the Bouncy Castle Inc. BCPKIX-FIPS 2.0.11, 2.1.11
  • Legion of the Bouncy Castle Inc. BCPIX-LTS 2.73.11
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap, 0:2.5.5-24.SP12_redhat_00016.1.el7eap, 0:2.5.5-30.SP12_redhat_00020.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:4.1.135-1.Final_redhat_00001.1.el7eap, 0:5.0.31-3.SP2_redhat_00001.1.el7eap, 0:7.4.25-2.GA_redhat_00001.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:1.5.26-2.Final_redhat_00001.1.el8eap, 0:1.10.0-46.Final_redhat_00044.1.el8eap, 0:2.2.40-1.SP3_redhat_00001.1.el8eap, 0:2.3.14-11.SP11_redhat_00001.1.el8eap, 0:2.5.5-24.SP12_redhat_00016.1.el8eap, 0:2.5.5-30.SP12_redhat_00020.1.el8eap, 0:2.16.0-22.redhat_00057.1.el8eap, 0:2.18.8-1.redhat_00003.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:5.0.31-3.SP2_redhat_00001.1.el8eap, 0:7.4.25-2.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:1.5.26-2.Final_redhat_00001.1.el9eap, 0:1.10.0-46.Final_redhat_00044.1.el9eap, 0:2.2.40-1.SP3_redhat_00001.1.el9eap, 0:2.3.14-11.SP11_redhat_00001.1.el9eap, 0:2.5.5-24.SP12_redhat_00016.1.el9eap, 0:2.5.5-30.SP12_redhat_00020.1.el9eap, 0:2.16.0-22.redhat_00057.1.el9eap, 0:2.18.8-1.redhat_00003.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:5.0.31-3.SP2_redhat_00001.1.el9eap, 0:7.4.25-2.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA 1.84.0.redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.84.0-1.redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.0.1-4.Final_redhat_00002.1.el9eap, 0:1.0.3-1.redhat_00001.1.el9eap, 0:1.84.0-1.redhat_00001.1.el9eap, 0:2.0.3-1.redhat_00001.1.el9eap, 0:2.0.5-1.redhat_00001.1.el9eap, 0:2.1.4-1.redhat_00001.1.el9eap, 0:2.2.21-5.redhat_00003.1.el9eap, 0:2.40.0-6.redhat_00012.1.el9eap, 0:3.1.12-1.redhat_00001.1.el9eap, 0:3.6.1-1.redhat_00001.1.el9eap, 0:3.6.2-1.Final_redhat_00001.1.el9eap, 0:3.7.19-1.Final_redhat_00001.1.el9eap, 0:4.0.6-1.redhat_00001.1.el9eap, 0:4.1.132-1.Final_redhat_00001.1.el9eap, 0:6.6.48-1.Final_redhat_00001.1.el9eap, 0:7.2.6-1.Final_redhat_00001.1.el9eap, 0:8.1.6-5.GA_redhat_00007.1.el9eap, 0:16.1.0-1.Final_redhat_00001.1.el9eap, 0:33.0.0-3.jre_redhat_00004.1.el9eap, 0:801.6.0-1.GA_redhat_00001.1.el9eap
  • Red Hat OpenShift Developer Tools and Services 4.12 1786628667
  • Red Hat OpenShift Developer Tools and Services 4.13 1786628681
  • Red Hat OpenShift Developer Tools and Services 4.14 1786533561
  • Red Hat OpenShift Developer Tools and Services 4.15 1786533565
  • Red Hat OpenShift Developer Tools and Services 4.16 1787125166
  • Red Hat OpenShift Developer Tools and Services 4.17 1787124635
  • Red Hat OpenShift Developer Tools and Services 4.18 1787125069
  • Red Hat OpenShift Developer Tools and Services 4.19 1787124632
  • Red Hat OpenShift Developer Tools and Services 4.20 1787124925
  • Red Hat OpenShift Developer Tools and Services 4.21 1787125311
  • Red Hat OpenShift Developer Tools and Services 4.22 1787124779
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779359423, 1779528224
  • bouncycastle Debian 14 1.86-1

debian advisories DEBIAN-CVE-2026-5588

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • eap8-angus jboss enterprise application platform 8.1 2.0.5-1.redhat_00001.1.el8eap
  • eap8-guava jboss enterprise application platform 8.1 33.0.0-3.jre_redhat_00004.1.el8eap

red hat advisories RHSA-2026:76129RHSA-2026:76130RHSA-2026:76128RHSA-2026:53645RHSA-2026:53646RHSA-2026:53644

  • bouncycastle openSUSE Tumbleweed 1.84-1.1

opensuse advisories openSUSE-SU-2026:10571-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5588 updated cvss 7.5

bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid

  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat build of Apache Camel 4 for Quarkus 3 bcpkix-jdk18on
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 bcpkix-jdk18on Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Fuse 7 bcpkix-jdk15on, bcpkix-jdk18on, bcpkix-jdk15to18
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7 bcpkix-jdk15on Red Hat JBoss Enterprise Application Platform 8 bcpkix-jdk15on, bcpkix-jdk18on, bcpkix-jdk15to18 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8
    affected: workaround, no fix available
  • Red Hat Process Automation 7 bcpkix-jdk15on, bcpkix-jdk15to18
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-85
    fixed: vendor fix RHSA-2026:76134
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:60249
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:60248
show 27 more
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:60246
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:60250
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat AMQ Broker 7.12.7
    fixed: vendor fix RHSA-2026:14276
  • Red Hat AMQ Broker 7.13.5
    fixed: vendor fix RHSA-2026:14272
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
    fixed: vendor fix RHSA-2026:13631
  • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
    fixed: vendor fix RHSA-2026:17668
  • Red Hat build of Quarkus 3.20.6.SP1 bcpkix-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:11720
  • Red Hat build of Quarkus 3.27.3.SP1 bcpkix-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:11721
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-2.GA_redhat_00001.1.el7eap, eap7-jackson-core 2.18.8-1.redhat_00003.1.el7eap, eap7-netty 4.1.135-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-jackson-databind 2.18.8-1.redhat_00003.1.el7eap, eap7-netty-all 4.1.135-1.Final_redhat_00001.1.el7eap, +78 more
    fixed: vendor fix RHSA-2026:53644
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-bouncycastle 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pkix 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-prov 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-util 1.84.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail 1.84.0-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2026:18054
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-angus 2.0.5-1.redhat_00001.1.el9eap, eap8-yasson 3.0.4-5.redhat_00007.1.el9eap, eap8-jctools 4.0.6-1.redhat_00001.1.el9eap, eap8-angus-mail 2.0.5-1.redhat_00001.1.el9eap, eap8-guava 33.0.0-3.jre_redhat_00004.1.el9eap, eap8-wildfly 8.1.6-5.GA_redhat_00007.1.el9eap, +77 more
    fixed: vendor fix RHSA-2026:18055
  • Red Hat JBoss Enterprise Application Platform 7.4.25
    fixed: vendor fix RHSA-2026:53806
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA bcpkix-jdk18on 1.84.0.redhat-00001
    fixed: vendor fix RHSA-2026:18059
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/openvsx-rhel9 1779528224, devspaces/pluginregistry-rhel9 1779359423
    fixed: vendor fix RHSA-2026:21772
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2026:76128
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2026:76129
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2026:76130
  • Red Hat Single Sign-On 7.6.13
    fixed: vendor fix RHSA-2026:76132
  • Red Hat Cryostat 4 bcpkix-jdk18on
    not affected: component not present
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1786628706
    not affected: vulnerable code not present

25 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.bouncycastle:bcpkix-jdk18on
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-jdk15to18
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-jdk15on
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-jdk14
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-debug-jdk18on
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-debug-jdk15to18
>=1.49, <1.84
1.84
maven org.bouncycastle:bcpkix-debug-jdk14
>=1.49, <1.84
1.84

Affected products

  • Legion of the Bouncy Castle Inc. BC-JAVA
  • Legion of the Bouncy Castle Inc. BCPKIX-FIPS
  • Legion of the Bouncy Castle Inc. BCPIX-LTS
  • Red Hat Red Hat AMQ Broker 7.12.7
  • Red Hat Red Hat AMQ Broker 7.13.5
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • Red Hat Red Hat build of Quarkus 3.20.6.SP1
  • Red Hat Red Hat build of Quarkus 3.27.3.SP1
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat OpenShift Developer Tools and Services 4.12
  • Red Hat OpenShift Developer Tools and Services 4.13
  • Red Hat OpenShift Developer Tools and Services 4.14
  • Red Hat OpenShift Developer Tools and Services 4.15
  • Red Hat OpenShift Developer Tools and Services 4.16
  • Red Hat OpenShift Developer Tools and Services 4.17
  • Red Hat OpenShift Developer Tools and Services 4.18
  • Red Hat OpenShift Developer Tools and Services 4.19
  • Red Hat OpenShift Developer Tools and Services 4.20
  • Red Hat OpenShift Developer Tools and Services 4.21
  • Red Hat OpenShift Developer Tools and Services 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Cryostat 4
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm
  • CWE-347 Improper Verification of Cryptographic Signature
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.