CVE-2026-59641

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips versions prior to 1.0.7 Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips versions prior to 2.0.7 Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips versions prior to 2.1.7

Description The S/MIME validator trusts the signer-asserted signingTime during path validation, which can lead to security issues during the verification of digital signatures.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips to version 1.0.7 or later for the 1.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips to version 2.0.7 or later for the 2.0.X series. Update Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips and bcjmail-fips to version 2.1.7 or later for the 2.1.X series.