Is CVE-2026-59643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59643 being exploited in the wild.

How severe is CVE-2026-59643?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Which products and versions are affected?

Bouncycastle Bouncy Castle for Java before 1.85; Bouncycastle Bouncy Castle for Java FIPS before bcpg-fips 2.0.13.

Is there a fix for CVE-2026-59643?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59643 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59643?

Check whether you run Bouncycastle Bcpg-Fips. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59643: Bouncycastle OpenPGP signature policy failures silently ignored

CVE-2026-59643 · Severity: high · CVSS 7.5 · Published 2026-08-03

Bouncy Castle is a cryptographic library used by Java applications to implement encryption and digital signatures. This vulnerability causes OpenPGP inline-signature policy checks to fail silently, allowing digitally signed messages that should be rejected to be accepted without warning. An attacker could forge or manipulate signed messages that appear valid to applications relying on signature verification.

Vendors: Bouncycastle.

Quick answers

Is CVE-2026-59643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59643 being exploited in the wild.
How severe is CVE-2026-59643?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: Bouncycastle Bouncy Castle for Java before 1.85; Bouncycastle Bouncy Castle for Java FIPS before bcpg-fips 2.0.13.
Is there a fix for CVE-2026-59643?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59643 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59643?: Check whether you run Bouncycastle Bcpg-Fips. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Bouncy Castle's OpenPGP inline-signature policy validation logic, where policy failures are silently ignored rather than raising an exception or returning a failure status. This affects the bcpg component responsible for OpenPGP message processing. The vulnerability is present in Bouncy Castle for Java before version 1.85 and in the FIPS-validated variant (BC-FJA) before bcpg-fips 2.0.13. An attacker can exploit this by crafting OpenPGP messages with invalid inline signatures that bypass policy checks, potentially leading to acceptance of forged or tampered signed content. Applications using affected versions must upgrade to patched releases.

Affected products

Bouncycastle Bouncy Castle for Java before 1.85
Bouncycastle Bouncy Castle for Java FIPS before bcpg-fips 2.0.13

Timeline

2026-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.