{"id":"CVE-2026-59642","title":"In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present","summary":"In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips …","severity":"high","cwe":["CWE-354"],"published":"2026-08-03","updated":"2026-08-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59642","references":[{"url":"https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE-2026-59642","label":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59642.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59642"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510204"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59642"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59642"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-03T01:21:07.813Z","epss":0.00303,"epssPercentile":0.22912,"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","affected":["ceph_storage 9","enterprise_linux 8","enterprise_linux 9","jboss_enterprise_application_platform 7","single_sign_on 7"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","slug":"CVE-2026-59642","body":"## Overview\n\nIn Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat Build of Keycloak, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat Ceph Storage 9, Red Hat AMQ Broker 7, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59642.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201833,"id":"CVE-2026-59642","ts":1789399743091,"field":"cvss","old":null,"new":"7.5"},{"seq":201832,"id":"CVE-2026-59642","ts":1789399743091,"field":"severity","old":"none","new":"high"},{"seq":200563,"id":"CVE-2026-59642","ts":1789397412186,"field":"cvss","old":"7.5","new":null},{"seq":200562,"id":"CVE-2026-59642","ts":1789397412186,"field":"severity","old":"high","new":"none"},{"seq":198480,"id":"CVE-2026-59642","ts":1789392001456,"field":"cvss","old":null,"new":"7.5"},{"seq":198479,"id":"CVE-2026-59642","ts":1789392001456,"field":"severity","old":"none","new":"high"},{"seq":196273,"id":"CVE-2026-59642","ts":1789383612067,"field":"cvss","old":"7.5","new":null},{"seq":196272,"id":"CVE-2026-59642","ts":1789383612067,"field":"severity","old":"high","new":"none"},{"seq":195202,"id":"CVE-2026-59642","ts":1789380497168,"field":"cvss","old":null,"new":"7.5"},{"seq":195201,"id":"CVE-2026-59642","ts":1789380497168,"field":"severity","old":"none","new":"high"},{"seq":193989,"id":"CVE-2026-59642","ts":1789378551958,"field":"cvss","old":"7.5","new":null},{"seq":193988,"id":"CVE-2026-59642","ts":1789378551958,"field":"severity","old":"high","new":"none"},{"seq":192776,"id":"CVE-2026-59642","ts":1789376426084,"field":"cvss","old":null,"new":"7.5"},{"seq":192775,"id":"CVE-2026-59642","ts":1789376426084,"field":"severity","old":"none","new":"high"},{"seq":191563,"id":"CVE-2026-59642","ts":1789373454877,"field":"cvss","old":"7.5","new":null},{"seq":191562,"id":"CVE-2026-59642","ts":1789373454877,"field":"severity","old":"high","new":"none"},{"seq":190348,"id":"CVE-2026-59642","ts":1789369345936,"field":"cvss","old":null,"new":"7.5"},{"seq":190347,"id":"CVE-2026-59642","ts":1789369345936,"field":"severity","old":"none","new":"high"},{"seq":189135,"id":"CVE-2026-59642","ts":1789368282955,"field":"cvss","old":"7.5","new":null},{"seq":189134,"id":"CVE-2026-59642","ts":1789368282955,"field":"severity","old":"high","new":"none"},{"seq":187918,"id":"CVE-2026-59642","ts":1789365161987,"field":"cvss","old":null,"new":"7.5"},{"seq":187917,"id":"CVE-2026-59642","ts":1789365161987,"field":"severity","old":"none","new":"high"},{"seq":186705,"id":"CVE-2026-59642","ts":1789363306379,"field":"cvss","old":"7.5","new":null},{"seq":186704,"id":"CVE-2026-59642","ts":1789363306379,"field":"severity","old":"high","new":"none"},{"seq":185491,"id":"CVE-2026-59642","ts":1789361123040,"field":"cvss","old":null,"new":"7.5"},{"seq":185490,"id":"CVE-2026-59642","ts":1789361123040,"field":"severity","old":"none","new":"high"},{"seq":184278,"id":"CVE-2026-59642","ts":1789358181382,"field":"cvss","old":"7.5","new":null},{"seq":184277,"id":"CVE-2026-59642","ts":1789358181382,"field":"severity","old":"high","new":"none"},{"seq":182529,"id":"CVE-2026-59642","ts":1789354238612,"field":"cvss","old":null,"new":"7.5"},{"seq":182528,"id":"CVE-2026-59642","ts":1789354238612,"field":"severity","old":"none","new":"high"},{"seq":181322,"id":"CVE-2026-59642","ts":1789353154152,"field":"cvss","old":"7.5","new":null},{"seq":181321,"id":"CVE-2026-59642","ts":1789353154152,"field":"severity","old":"high","new":"none"},{"seq":180115,"id":"CVE-2026-59642","ts":1789350187372,"field":"cvss","old":null,"new":"7.5"},{"seq":180114,"id":"CVE-2026-59642","ts":1789350187372,"field":"severity","old":"none","new":"high"},{"seq":178908,"id":"CVE-2026-59642","ts":1789348122953,"field":"cvss","old":"7.5","new":null},{"seq":178907,"id":"CVE-2026-59642","ts":1789348122953,"field":"severity","old":"high","new":"none"},{"seq":177701,"id":"CVE-2026-59642","ts":1789346293650,"field":"cvss","old":null,"new":"7.5"},{"seq":177700,"id":"CVE-2026-59642","ts":1789346293650,"field":"severity","old":"none","new":"high"},{"seq":176494,"id":"CVE-2026-59642","ts":1789343044345,"field":"cvss","old":"7.5","new":null},{"seq":176493,"id":"CVE-2026-59642","ts":1789343044345,"field":"severity","old":"high","new":"none"},{"seq":174611,"id":"CVE-2026-59642","ts":1789334801255,"field":"cvss","old":null,"new":"7.5"},{"seq":174610,"id":"CVE-2026-59642","ts":1789334801255,"field":"severity","old":"none","new":"high"},{"seq":173406,"id":"CVE-2026-59642","ts":1789333530419,"field":"cvss","old":"7.5","new":null},{"seq":173405,"id":"CVE-2026-59642","ts":1789333530419,"field":"severity","old":"high","new":"none"},{"seq":172220,"id":"CVE-2026-59642","ts":1789331030680,"field":"cvss","old":null,"new":"7.5"},{"seq":172219,"id":"CVE-2026-59642","ts":1789331030680,"field":"severity","old":"none","new":"high"},{"seq":171034,"id":"CVE-2026-59642","ts":1789328646535,"field":"cvss","old":"7.5","new":null},{"seq":171033,"id":"CVE-2026-59642","ts":1789328646535,"field":"severity","old":"high","new":"none"},{"seq":169829,"id":"CVE-2026-59642","ts":1789327070022,"field":"cvss","old":null,"new":"7.5"},{"seq":169828,"id":"CVE-2026-59642","ts":1789327070022,"field":"severity","old":"none","new":"high"}]}