CVE-2026-5588

OVERVIEW CVE-2026-5588 is a use of broken or risky cryptographic algorithm vulnerability affecting the Bouncy Castle cryptographic libraries. Specifically, it impacts BC-JAVA versions 1.67 through 1.83 and BCPKIX-FIPS versions 2.0.6 through 2.0.10 and 2.1.7 through 2.1.10. The flaw is located in the JcaContentVerifierProviderBuilder.java file within the PKIX modules of both libraries. SEVERITY The vulnerability relates to improper use of cryptographic algorithms in content verification processes. While specific CVSS scoring is not available, the FAUCET Risk Score of 44.0 out of 100 indicates a moderate threat level. The cryptographic weakness could potentially allow attackers to bypass signature verification or other cryptographic protections, though the exact attack complexity and prerequisites remain limited in public documentation. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The extremely low EPSS score of 0.0001 suggests minimal likelihood of exploitation attempts. However, organizations using affected versions of these widely-deployed cryptographic libraries should prioritize updating to patched versions 1.84 or later for BC-JAVA and 2.0.11 or 2.1.11 or later for BCPKIX-FIPS.