Is CVE-2026-5588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5588 being exploited in the wild.

How severe is CVE-2026-5588?

Medium severity, with a CVSS score of 4, published 15 April 2026.

Which products and versions are affected?

Bouncy Castle BC-JAVA bcpkix 1.67 to 1.80.1, 1.81, 1.82 to 1.83; Bouncy Castle BCPKIX-FIPS bcpkix 2.0.6 to 2.0.10, 2.1.7 to 2.1.10; Bouncy Castle BCPKIX-LTS bcpkix 2.73.7 to 2.73.10; org.bouncycastle:bcpkix-debug-jdk14 (Maven) >= 1.49, < 1.84, ECOSYSTEM:introduced=1.49,fixed=1.84; and 6 more.

Is there a fix for CVE-2026-5588?

Yes. org.bouncycastle:bcpkix-debug-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk18on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk18on (Maven): upgrade to 1.84 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5588 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5588?

Check whether you run Bouncy Castle BC-JAVA bcpkix, Bouncy Castle BCPKIX-FIPS bcpkix, Bouncy Castle BCPKIX-LTS bcpkix or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5588: Bouncy Castle BC-JAVA signature bypass in CompositeVerifier

Q: Is there a fix for CVE-2026-5588?

Yes. org.bouncycastle:bcpkix-debug-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk18on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk18on (Maven): upgrade to 1.84 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-5588 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-5588?

Check whether you run Bouncy Castle BC-JAVA bcpkix, Bouncy Castle BCPKIX-FIPS bcpkix, Bouncy Castle BCPKIX-LTS bcpkix or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5588 · Severity: medium · CVSS 4 · Published 2026-04-15

Bouncy Castle is a widely used Java library that provides cryptographic functions for securing data and communications. A vulnerability in its certificate handling module allows certain digital signatures to be incorrectly treated as valid even when they are empty. This could potentially allow an attacker to bypass security checks in applications that rely on these specific composite signature types for authentication or data integrity.

Technologies: org.bouncycastle:bcpkix-jdk18on (Maven). Vendors: Bouncy Castle, Maven.

Quick answers

Is CVE-2026-5588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5588 being exploited in the wild.
How severe is CVE-2026-5588?: Medium severity, with a CVSS score of 4, published 15 April 2026.
Which products and versions are affected?: Bouncy Castle BC-JAVA bcpkix 1.67 to 1.80.1, 1.81, 1.82 to 1.83; Bouncy Castle BCPKIX-FIPS bcpkix 2.0.6 to 2.0.10, 2.1.7 to 2.1.10; Bouncy Castle BCPKIX-LTS bcpkix 2.73.7 to 2.73.10; org.bouncycastle:bcpkix-debug-jdk14 (Maven) >= 1.49, < 1.84, ECOSYSTEM:introduced=1.49,fixed=1.84; and 6 more.
Is there a fix for CVE-2026-5588?: Yes. org.bouncycastle:bcpkix-debug-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-debug-jdk18on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk14 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15on (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk15to18 (Maven): upgrade to 1.84 or later; org.bouncycastle:bcpkix-jdk18on (Maven): upgrade to 1.84 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5588 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5588?: Check whether you run Bouncy Castle BC-JAVA bcpkix, Bouncy Castle BCPKIX-FIPS bcpkix, Bouncy Castle BCPKIX-LTS bcpkix or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.bouncycastle:bcpkix-debug-jdk14 (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-debug-jdk14 to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-debug-jdk15to18 (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-debug-jdk15to18 to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-debug-jdk18on (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-debug-jdk18on to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-jdk14 (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-jdk14 to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-jdk15on (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-jdk15on to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-jdk15to18 (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-jdk15to18 to 1.84 in your pom.xml or build.gradle

org.bouncycastle:bcpkix-jdk18on (Maven): upgrade to 1.84 or later

# set org.bouncycastle:bcpkix-jdk18on to 1.84 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Bouncy Castle Java PKIX modules (BC-JAVA, BCPKIX-FIPS, and BCPKIX-LTS) within the JcaContentVerifierProviderBuilder.java component. The implementation of the early draft COMPOSITE signature type fails to verify that at least one signature is present in a sequence. Consequently, the CompositeVerifier treats an empty signature sequence as valid. An attacker could exploit this to bypass signature verification requirements in systems utilizing these draft composite signatures. The issue is resolved by ensuring the verifier checks that at least one signature has been validated.

Affected products

Bouncy Castle BC-JAVA bcpkix 1.67 to 1.80.1, 1.81, 1.82 to 1.83
Bouncy Castle BCPKIX-FIPS bcpkix 2.0.6 to 2.0.10, 2.1.7 to 2.1.10
Bouncy Castle BCPKIX-LTS bcpkix 2.73.7 to 2.73.10

Identifiers

CVE-2026-5588
GHSA-wg6q-6289-32hp

Timeline

2026-04-05: patched: Fix committed to bc-java repository
2026-04-15: advisory: Initial advisory published
2026-05-18: other: Advisory updated with expanded version impact and LTS details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.