Is CVE-2026-71891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71891 being exploited in the wild.

How severe is CVE-2026-71891?

Informational severity, published 3 October 2026.

Which products and versions are affected?

Bouncy Castle for Java before 1.86.

Is there a fix for CVE-2026-71891?

Yes: fixed in Bouncy Castle for Java 1.86. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71891 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71891?

Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71891: Bouncy Castle for Java BLS signature phantom signer

CVE-2026-71891 · Severity: info · Published 2026-10-03

Bouncy Castle, a widely-used cryptographic library for Java, contains a flaw in its BLS12-381 signature scheme implementation. An attacker can construct a specially-crafted public key on a non-standard elliptic curve that passes validation checks but does not correspond to a legitimate signer. This allows forged aggregate signatures to be accepted as valid, effectively allowing an attacker to impersonate a signer without providing a real signature.

Technologies: Bouncy Castle for Java. Vendors: Bouncy Castle.

Quick answers

Is CVE-2026-71891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71891 being exploited in the wild.
How severe is CVE-2026-71891?: Informational severity, published 3 October 2026.
Which products and versions are affected?: Bouncy Castle for Java before 1.86.
Is there a fix for CVE-2026-71891?: Yes: fixed in Bouncy Castle for Java 1.86. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71891 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71891?: Check whether you run Bouncy Castle for Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Bouncy Castle for Java 1.86

Technical details

The BLS12_381BasicScheme.keyValidate function fails to verify that public keys use the canonical G1 curve before performing subgroup checks. An attacker can supply an ECPoint on a foreign curve with the same field characteristic but different equation and cofactor, which will pass validation because ECPoint.satisfiesOrder returns true when cofactor is one. In pairing operations, such a point contributes the identity element, allowing an aggregate signature to be accepted without an actual signature from that key-message pair. The vulnerability requires an application to explicitly construct ECPoints on non-canonical curves and accept them as keys; standard 48-byte compressed-point decoding is unaffected.

Affected products

Bouncy Castle Bouncy Castle for Java before 1.86

Timeline

2026-10-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.