CVE-2026-5588 PKIX draft CompositeVerifier accepts empty signature sequence as valid.
The Bouncy Castle Java library incorrectly accepts empty signature sequences as valid, allowing attackers to bypass cryptographic verification checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5588?
CVE-2026-5588 is a medium-severity vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
Which versions are affected by CVE-2026-5588?
14 open source packages ship an affected version, including org.bouncycastle:bcpkix-debug-jdk14, org.bouncycastle:bcpkix-debug-jdk15to18 and org.bouncycastle:bcpkix-debug-jdk18on.
| Package | Affected | Fixed in |
|---|---|---|
org.bouncycastle:bcpkix-debug-jdk14 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-debug-jdk14 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-debug-jdk15to18 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-debug-jdk15to18 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-debug-jdk18on Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-debug-jdk18on Maven | From 1.49 | 1.84 |
8 more packages
org.bouncycastle:bcpkix-jdk14 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk14 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk15on Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk15on Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk15to18 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk15to18 Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk18on Maven | From 1.49 | 1.84 |
org.bouncycastle:bcpkix-jdk18on Maven | From 1.49 | 1.84 |
How do I fix CVE-2026-5588?
Upgrade org.bouncycastle:bcpkix-debug-jdk14 to 1.84 or later.
Is CVE-2026-5588 being exploited?
There is no known exploitation of CVE-2026-5588 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-OX95467, CLEANSTART-2026-XR61334, DEBIAN-CVE-2026-5588, ECHO-e567-eb6f-d89b, GHSA-wg6q-6289-32hp, MINI-2fmj-85mm-77mq and 48 more.