CVE-2026-59642
High · 7.5CVSS
7.5
EPSS
—
Published
Aug 3, 2026
CISA due date
—
The record
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-35501 When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both… CWE-354
- CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content. CWE-354
- CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME)… CWE-354
- CVE-2026-82549 A vulnerability was identified in Linux Foundation Magma 1.9.0. CWE-354
- CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a… CWE-354
- CVE-2026-75803 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can… CWE-354
- CVE-2026-12816 In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via… CWE-354
- CVE-2026-12817 In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on… CWE-354