Is CVE-2026-71886 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71886 being exploited in the wild.

How severe is CVE-2026-71886?

Informational severity, published 3 October 2026.

Is there a fix for CVE-2026-71886?

Yes: fixed in 1.86. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71886 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71886?

Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71886: Bouncy Castle for Java OpenPGP certification validation bypass

CVE-2026-71886 · Severity: info · Published 2026-10-03

Bouncy Castle for Java is a widely-used cryptographic library that implements OpenPGP certificate handling. Before version 1.86, the library incorrectly accepted third-party certifications and trust delegations from subkeys that lacked the proper cryptographic authority to issue them, potentially allowing an attacker with a compromised restricted subkey to falsely claim the primary key's identity. This could deceive applications relying on the library's validation functions into trusting forged identity assertions or trust relationships.

Technologies: Bouncy Castle for Java. Vendors: Bouncy Castle.

Quick answers

Is CVE-2026-71886 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71886 being exploited in the wild.
How severe is CVE-2026-71886?: Informational severity, published 3 October 2026.
Which products and versions are affected?: Bouncy Castle for Java before 1.86.
Is there a fix for CVE-2026-71886?: Yes: fixed in 1.86. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71886 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71886?: Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.86

Technical details

The OpenPGP certificate API in Bouncy Castle for Java before 1.86 failed to validate that the issuing component key held the CERTIFY_OTHER flag (RFC 9580 sec. 5.2.3.29) when accepting third-party certifications and delegations via getCertificationBy() and getDelegationBy(). A subkey bound only with SIGN_DATA or encryption-only RSA subkeys could therefore issue false User ID certifications or full-trust delegations that the API would return as valid, attributing them to the primary key. The fix restricts acceptance to primary keys or subkeys explicitly holding CERTIFY_OTHER at the time of signature creation, preserving backward compatibility for legacy certificates without key flags.

Affected products

Bouncy Castle Bouncy Castle for Java before 1.86

Timeline

2026-10-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.