CVE-2026-59642: Bouncy Castle Auth Bypass Vulnerability

CVE-2026-59642 Overview

CVE-2026-59642 affects the Bouncy Castle for Java cryptographic library. The flaw allows Cryptographic Message Syntax (CMS) AuthenticatedData content to remain unbound to the Message Authentication Code (MAC) when authenticated attributes (authAttrs) are present. An attacker positioned on the network can tamper with protected message content while the MAC continues to validate against the attributes. The issue impacts Bouncy Castle for Java before 1.85, Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS across the 1.0.X, 2.0.X, and 2.1.X series. The weakness is categorized as [CWE-354] Improper Validation of Integrity Check Value.

Critical Impact
Attackers can modify authenticated CMS payloads without invalidating the MAC, breaking the integrity guarantees relied upon by applications using AuthenticatedData.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12, 2.0.12, and 2.1.12

Discovery Timeline

2026-08-03 - CVE-2026-59642 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-59642

Vulnerability Analysis

The defect exists in the CMS AuthenticatedData processing path within Bouncy Castle. When authAttrs are included in an AuthenticatedData structure, the implementation computes the MAC over the authenticated attributes but does not bind the actual content to that MAC through a messageDigest attribute. Applications relying on AuthenticatedData to guarantee message integrity accept modified payloads as authentic. This breaks a core assumption in CMS: that a successful MAC verification implies the content was not tampered with in transit.

Root Cause

The root cause is a missing integrity binding between the authenticated attribute set and the encapsulated content. RFC 5652 requires that when authAttrs are present, a messageDigest attribute containing the hash of the content must be included and covered by the MAC. Bouncy Castle omitted this verification step in RecipientInformation, so the content digest was never validated against the MAC-protected attributes.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker intercepting or generating CMS AuthenticatedData messages can substitute alternate content while keeping the authAttrs and MAC intact. Consuming applications validate the MAC over the attributes, see success, and process attacker-controlled data as authentic. The impact is limited to integrity (VI:H); confidentiality and availability are not directly affected.

java

// Patch excerpt from RecipientInformation.java
// Source: https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7
 import org.bouncycastle.asn1.ASN1Encoding;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.CMSAttributes;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Exceptions;
 import org.bouncycastle.util.io.Streams;

The patch introduces imports for CMSAttributes, Attribute, and AttributeTable so the recipient can extract and verify the messageDigest attribute against the computed digest of the content. See the upstream commit and the Bouncy Castle advisory wiki for full details.

Detection Methods for CVE-2026-59642

Indicators of Compromise

CMS AuthenticatedData messages whose decoded content does not match a messageDigest attribute in authAttrs
Java applications loading bcprov, bcpkix, or bcpkix-fips JARs at versions below the fixed releases
Unexpected changes in downstream data derived from CMS payloads that previously validated as authentic

Detection Strategies

Inventory application dependencies for vulnerable Bouncy Castle artifact versions using software composition analysis tooling
Instrument CMS handling code to log MAC verification results alongside content digests for offline comparison
Alert on runtime loading of Bouncy Castle classes from versions below 1.85, 2.73.12, or the fixed FIPS releases

Monitoring Recommendations

Monitor build pipelines and artifact registries for reintroduction of vulnerable bcprov, bcpkix, or bcpkix-fips versions
Track integrity-verification failures and anomalies in services processing signed or authenticated CMS content
Correlate application logs with network telemetry to identify tampered CMS payloads reaching backend systems

How to Mitigate CVE-2026-59642

Immediate Actions Required

Upgrade Bouncy Castle for Java to version 1.85 or later
Upgrade Bouncy Castle for Java LTS to 2.73.12 or later
Upgrade Bouncy Castle for Java FIPS bcpkix-fips to 1.0.12, 2.0.12, or 2.1.12 depending on the deployed series
Rebuild and redeploy all applications that bundle vulnerable Bouncy Castle JARs

Patch Information

The fix binds the AuthenticatedData content to the MAC by validating the messageDigest attribute inside authAttrs. The change is delivered in commit 2117f316 and documented in the CVE-2026-59642 wiki entry.

Workarounds

Avoid processing untrusted CMS AuthenticatedData structures until the library is upgraded
Prefer SignedData or AuthEnvelopedData structures, which are not affected by this specific defect
If upgrade is delayed, add application-layer validation that recomputes the content digest and compares it to any messageDigest attribute present

bash

# Verify installed Bouncy Castle versions in a Maven project
mvn dependency:tree | grep -E 'bcprov|bcpkix'

# Enforce minimum versions via Maven dependencyManagement
# <dependency>
#   <groupId>org.bouncycastle</groupId>
#   <artifactId>bcpkix-jdk18on</artifactId>
#   <version>1.85</version>
# </dependency>