Executive brief
Bouncy Castle is a widely-used cryptographic library that processes digitally signed messages (S/MIME). The vulnerability allows attackers to forge or manipulate the signing timestamp in S/MIME messages, potentially leading to acceptance of expired certificates or signatures that should have been rejected. This could enable unauthorized access or allow an attacker to bypass security validations on signed content.
Technical details
The vulnerability exists in the S/MIME message validator component of Bouncy Castle for Java, which improperly trusts the signer-asserted signingTime attribute during certificate path validation. This allows an attacker to present a signing time that differs from the actual time of signature creation, potentially causing the validator to accept certificates that were expired or not yet valid at the actual time of signing. The flaw affects cryptographic validation logic and requires network-accessible S/MIME processing. Patches are available in versions 1.85 and later (standard), 2.73.12 and later (LTS), and 1.0.7, 2.0.7, and 2.1.7 respectively for the FIPS variants.
Affected products
- Bouncycastle Bouncy Castle for Java before 1.85
- Bouncycastle Bouncy Castle for Java LTS before 2.73.12
- Bouncycastle Bouncy Castle for Java FIPS bcmail-fips and bcjmail-fips before 1.0.7 (1.0.X), before 2.0.7 (2.0.X), before 2.1.7 (2.1.X)
Timeline
- 2026-08-03: disclosed