CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59643?
CVE-2026-59643 has a risk score of 37, indicating a moderate level of severity.
What vulnerability does CVE-2026-59643 represent?
CVE-2026-59643 represents an issue where OpenPGP inline-signature policy failures are silently ignored in Bouncy Castle for Java.
How do I fix CVE-2026-59643?
To fix CVE-2026-59643, upgrade to Bouncy Castle for Java version 1.85 or later and Bouncy Castle for Java FIPS version bcpg-fips 2.0.13 or later.
Which versions of Bouncy Castle are affected by CVE-2026-59643?
CVE-2026-59643 affects Bouncy Castle for Java versions before 1.85 and Bouncy Castle for Java FIPS before bcpg-fips 2.0.13.
What is the impact of ignoring inline-signature policy failures as stated in CVE-2026-59643?
Ignoring inline-signature policy failures can lead to security vulnerabilities where unauthorized or invalid signatures may be accepted.