Description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).
This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.
This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA | >= 1.67, < 1.80.2; >= 1.81, < 1.81.1; >= 1.82, < 1.84 |
| Legion of the Bouncy Castle Inc. | BCPKIX-FIPS | >= 2.0.6, < 2.0.11; >= 2.1.7, < 2.1.11 |
| Legion of the Bouncy Castle Inc. | BCPIX-LTS | >= 2.73.7, < 2.73.11 |
| Red Hat | Red Hat AMQ Broker 7.12.7 | — |
| Red Hat | Red Hat AMQ Broker 7.13.5 | — |
| Red Hat | Red Hat AMQ Broker 7.14.1 | — |
| Red Hat | Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 | — |
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | — |
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | — |
| Red Hat | Red Hat build of Quarkus 3.20.6.SP1 | — |
| Red Hat | Red Hat build of Quarkus 3.27.3.SP1 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — |
References
- https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588
- https://access.redhat.com/errata/RHSA-2026:11720
- https://access.redhat.com/errata/RHSA-2026:11721
- https://access.redhat.com/errata/RHSA-2026:13631
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:14276
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:60239
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60256
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/security/cve/CVE-2026-5588
- https://bugzilla.redhat.com/show_bug.cgi?id=2458634
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json
Timeline
- Published
- Apr 15, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Awaiting Analysis