Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.bouncycastle:bcpkix-debug-jdk15to18

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3MavenPublished

    Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

    CVE-2026-5588 · GHSA-wg6q-6289-32hp

    Affected
    • Maven org.bouncycastle:bcpkix-debug-jdk15to18 >= 1.49, < 1.84
    Fixed in
    1.84· Vendor fix available
    Issue
    : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84.

    Recommended action: Upgrade to 1.84 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →