CVE-2026-5588

Aliases:GHSA-wg6q-6289-32hpDEBIAN-CVE-2026-5588CGA-26vh-cj23-x6c8CGA-289h-6jf8-gc3wCGA-28p3-56pv-3vh8CGA-2vvm-rqvv-v6mcCGA-35x6-6q5x-4873CGA-3978-r629-c24gCGA-3mg3-g9h9-p43qCGA-3pmg-xj5x-w9wpCGA-3xwq-rpm6-vw2xCGA-464x-xvmm-vr5rCGA-57mv-wvmq-pv7wCGA-59vv-j79x-28h4CGA-5h43-v7vw-8fx8CGA-5p7g-g9q6-jxgpCGA-5q87-vf75-vfxqCGA-5rrc-hxhq-cf63CGA-5vmc-8vqc-2863CGA-5w6r-xhvf-cq66CGA-627q-prcc-ff9jCGA-632g-6wrh-pg4vCGA-633j-v3hf-m39gCGA-638p-pxqf-w7crCGA-6j5r-wx8f-gc79CGA-6w8h-wc4m-p5gcCGA-7454-2qm5-6fvpCGA-7c68-jwjc-cfpxCGA-7gvm-hg4r-5ch4CGA-7hhf-c862-rj5hCGA-7vgw-v96f-48v8CGA-83gj-337f-xvgrCGA-8cwq-phqw-3293CGA-8fxq-5hjx-gmvpCGA-8vm2-7v97-pxr5CGA-95xf-vc3q-7r5wCGA-9874-vfqw-45m2CGA-9hj8-qq6f-r898CGA-9mwq-4p54-5hccCGA-9px9-w63v-rwv5CGA-9qm3-cwm5-83mcCGA-9r7h-84mr-v725CGA-9rm4-wx97-4m35CGA-f4xx-f45v-4wvmCGA-f72m-m5m6-r333CGA-fmj6-vw6r-q86jCGA-fpwm-47pw-pvgjCGA-fv8r-hg42-frprCGA-j4pq-4gx2-2ghqCGA-jfjm-7w7h-p747CGA-jx4c-6f9c-q47cCGA-m4q8-93jq-jc89CGA-mwg3-4r54-ccpxCGA-p525-6jcw-wrv4CGA-p9c9-gcq8-4x9cCGA-pqpq-6wm8-r6x7CGA-pvvh-7mq3-wprqCGA-237q-x5fg-mvwgCGA-26r7-qhr5-f6fhCGA-276c-w65q-g7p9CGA-2ch6-wqh5-866jCGA-2h9m-8w33-mrg9CGA-2j95-7g86-xx87CGA-2jmm-wfjm-4vw2CGA-2pc2-gjf3-636cCGA-2pgq-fww3-c7f4CGA-2qj5-3f9m-6r2wCGA-2w8j-wwp7-m68wCGA-2wpf-w6vv-f7pvCGA-33cr-hrjx-6885CGA-364q-mpcp-c7f4CGA-36v6-2xq4-6wg5CGA-37h3-8p5v-f87fCGA-397x-3w2h-rv49CGA-3mfv-qqwp-x547CGA-3q8j-96x3-2j8gCGA-3q9g-94j6-x5xmCGA-42h3-j2jv-4m6gCGA-46q9-vrpm-qj95CGA-497j-rfcv-5wwgCGA-4fcv-79cq-32frCGA-4fgh-4g5g-9g43CGA-4gc2-g3g6-qw63CGA-4jmc-v569-qwjvCGA-4m8j-pcq5-5v5cCGA-4p9v-4f5q-246mCGA-4pfp-hxjj-gfmrCGA-4pgg-8w3m-7c69CGA-4rp6-7hj6-5gqqCGA-52g2-2x49-37h6CGA-52rf-wwrc-mvp8CGA-52rq-cf2p-2377CGA-559x-j42v-gwhvCGA-55cr-3qwj-39g2CGA-5648-v9jq-rvv7CGA-56vg-wrmm-8mfpCGA-593m-6r79-v4pjCGA-5c62-v9jw-p9xhCGA-5gq5-9cvm-6f3mCGA-5hw9-xxrr-2x7cCGA-5mq3-p877-rvccCGA-5pj3-wx58-h4rmCGA-5w58-g2qm-2252CGA-63h7-fprh-r3pxCGA-645r-3f27-jjc8CGA-6522-cm2q-6g39CGA-65ch-4g2r-mv6jCGA-65hh-2rjc-4xx3CGA-65m3-xhwx-g237CGA-65mp-f929-xg8pCGA-6c7c-hmmx-g5frCGA-6f8g-8g3x-ccf6CGA-6m7v-c386-2rjcCGA-6p5v-qj8w-rg6hCGA-6p7x-x2h3-8j47CGA-6r34-9252-x2g7CGA-6rhf-4qfc-mf68CGA-6rhr-347v-8q33CGA-6vw2-79f7-2j52CGA-6x7m-wrjc-9p5mCGA-724w-w7v8-6fw2CGA-72pg-x8w2-2r2vCGA-74wv-r89j-wjfjCGA-74x2-q7qw-9mw7CGA-7895-62qw-xx7pCGA-7h99-fq82-9w79CGA-7mf4-hr9f-2fg6CGA-7p2w-8jcr-p648CGA-7qp4-ff47-427qCGA-7rc9-j95m-2f6rCGA-7v8w-r436-pj66CGA-7vxv-fwvf-hmhpCGA-7xh7-w3j6-wjv4CGA-82r3-m3h4-m2hgCGA-86w3-4364-f8rgCGA-88w9-48gg-pm9hCGA-8ff6-c9mr-hm8hCGA-8mmh-jvp9-pg8vCGA-8q84-4q8r-frppCGA-8qrc-j54h-3jrqCGA-8r39-x22g-9pghCGA-8rpc-crgm-r4rhCGA-8w5h-p85h-rxcpCGA-9452-c8q3-wfwpCGA-94rv-j5px-q66mCGA-97cw-r2vj-q97hCGA-997f-434c-h4m2CGA-9fc5-5wxf-gp5wCGA-9fqp-9hhf-9443CGA-9g47-pqgx-32rqCGA-9h86-x6pr-r9cgCGA-9h8v-6c5j-4jgwCGA-9v45-jx5f-648cCGA-9w8c-3624-hp95CGA-9wq9-g4jc-vv5rCGA-c599-jrfp-9522CGA-c622-3hfj-49x2CGA-c9h2-72gv-pgjmCGA-c9jj-rqx5-658rCGA-chj6-v4x5-wqqjCGA-cm3h-88gf-88vpCGA-cp45-m873-p225CGA-cq82-656m-qgqpCGA-cvv6-7j65-437cCGA-cwcc-rp45-v776CGA-cwrc-6pr3-p4rgCGA-f2qf-cj5m-c358CGA-f4h7-292x-hrppCGA-f8fp-cpx8-pwfgCGA-fj9p-j6rx-mjhjCGA-fq9q-w7jf-93m3CGA-frjp-q96q-vfpxCGA-g27q-rv94-mjcwCGA-g4gg-6vcx-xpfcCGA-g65c-mr5h-2747CGA-g7q5-wqm8-rmgmCGA-g97p-phhp-rcrvCGA-gf88-g37j-mgrxCGA-gj49-5c92-fx3mCGA-gjfh-mg6q-p8fxCGA-gmrg-f84m-5g3hCGA-gq84-hg8x-hxprCGA-gqvf-h2qh-g9pwCGA-gr77-89w9-vrwjCGA-grc2-wxrc-48r9CGA-gvmr-h4wr-4xrgCGA-gwg2-p9fh-hj58CGA-h25v-q2h6-f356CGA-h39w-g44h-g6hfCGA-h53j-5qrx-94hpCGA-h8rf-6j7r-fh8hCGA-h8vm-c9r2-qfgwCGA-h96g-mmfj-4fqvCGA-h9jw-2fq5-hv25CGA-hc6f-4p3v-rpvqCGA-hjf4-3c7x-xwjhCGA-hjph-r26p-vp5xCGA-hjw8-2rwg-q34vCGA-hq24-f7rh-3g94CGA-hv3h-239g-hq94CGA-hwfm-5php-gp69CGA-j4m8-455q-pxvpCGA-j55q-74gf-6w5cCGA-jhw9-g4xw-hj7fCGA-jhxp-qqjw-vqvrCGA-jmfr-vprq-vxh8CGA-jmpm-w99g-wfjxCGA-jqmj-p4g5-jrpcCGA-jxrc-2pw3-mhfgCGA-jxvg-gj43-35pqCGA-m39m-7wq7-qr9xCGA-m3j6-mqqw-mgcrCGA-m54w-jrx8-v8whCGA-m6hx-hfgv-jcvpCGA-m86r-q82f-9r8pCGA-mg7c-mqgj-vx2mCGA-mq5h-rpg9-hr5gCGA-mqq8-hwq3-mxrjCGA-p2gm-3hh3-qc7wCGA-p329-8559-hw5rCGA-p488-q9p4-f227CGA-p5j6-xwfh-4cf9CGA-p88v-jr29-7p2qCGA-pf32-3mgj-m8grCGA-phgx-jcwv-jq2gCGA-phww-hgrr-f7qfCGA-pjg6-xj7f-7whjCGA-px28-mw3m-qp5rCGA-q26m-w9m5-gfmhCGA-q2q3-546x-gp7vCGA-q4g2-gx34-fjw9CGA-q4jq-cxjw-52p9CGA-q5c4-47v8-fmrfCGA-q73m-m263-q79qCGA-q957-cjrm-gqwrCGA-qcqp-93w5-w5g8CGA-qfm6-7mc5-jqm6CGA-qhh9-hqv8-q8cmCGA-qhhv-qr8m-p7w8CGA-qjq5-7jh9-pxx5CGA-qp2j-f9xq-gm3wCGA-qpfm-q548-xqj7CGA-qpm4-289m-578gCGA-qpp3-2qw5-f34rCGA-qqp9-96p7-9p46CGA-qrxh-mgv3-92p6CGA-r539-q45v-xrpgCGA-r6gw-5pqf-9grjCGA-r8fp-v5r5-wwh2CGA-r8rj-vjmv-95r5CGA-rgh8-rrqg-x3v5CGA-rgpj-hhw3-7frqCGA-rh8r-9mmp-fvc7CGA-rmq3-jpq5-r8ccCGA-rmwm-3h9h-j868CGA-rq29-334h-6vwfCGA-rqrc-7hf9-v5ffCGA-rr33-6chx-6wg8CGA-rrq2-342c-773gCGA-rvp4-q2g7-h3gpCGA-rwx2-7x26-h6fwCGA-rx45-vw83-f64hCGA-v23x-vrvg-7mg9CGA-v357-3hpc-rv76CGA-v47f-rpjh-wqqqCGA-v4qc-h5wg-j9q4CGA-vfw5-v58w-gj9gCGA-vjg4-hcv5-c7w4CGA-vjh7-9cwm-8j7hCGA-vjrq-g623-wxgxCGA-vpcv-6w35-fxp7CGA-vpq6-prmh-3cj5CGA-vpwx-gx62-74m3CGA-vqq8-gwjq-fcjpCGA-vwf2-2m3f-56gjCGA-w22w-rcvr-5pvjCGA-w33x-938r-qwvcCGA-w4p5-54r4-pwfwCGA-w588-hprf-jf7gCGA-w6m5-jmqj-8mq5CGA-w6v2-gcwq-fc87CGA-w6w7-rp4f-45pcCGA-w6wv-r7jw-chxvCGA-w7pq-8hq2-cq52CGA-w83x-rj4x-4chgCGA-w867-m6cv-vjxgCGA-w88c-m67f-f2gxCGA-w9rm-gg4j-c235CGA-wcj9-m4vq-3mpwCGA-wcq2-x7p7-hgg6CGA-wfwc-84j5-wvqxCGA-whc4-xx56-rw9hCGA-wvhg-299q-wp5rCGA-ww72-p467-xq2pCGA-wx5w-f355-6c6mCGA-wxpf-rgwv-f3x2CGA-x3gp-g8qf-g5x5CGA-x3mj-vc75-hrhpCGA-x447-4q64-584fCGA-x4x8-98j2-w34xCGA-x822-9x94-2g8mCGA-x8f5-cpc3-pv94CGA-x94q-pc43-cqw5CGA-x9xx-9vp8-rvvwCGA-xcqp-xjj3-qpvxCGA-xf37-3qmm-mp5hCGA-xf7x-3j6g-c598CGA-xgmq-xj8v-78f8CGA-xmwj-gfxq-p36pCGA-xp29-f3xx-45c9CGA-xr9g-wr3p-pp3pCGA-xwq7-hwg3-xf6hCGA-28cf-22rx-r43hCGA-4fhw-6xf7-6r2qCGA-6gwh-q9fm-58frCGA-8xrr-pqv3-52jxCGA-cp6p-j24w-6j9vCGA-cq24-9gw3-2x3gCGA-cvcr-4q45-j8qjCGA-f597-rvj2-vhhhCGA-gg4h-mcv4-mjp5CGA-h2hg-mgmw-4x6vCGA-h7h6-68fr-wmhgCGA-h839-89m4-vc3qCGA-jq3f-vx56-3xw5CGA-m4pj-cf8r-74m2CGA-mf29-f6wh-6qjwCGA-pcrh-j6rx-8f2rCGA-qc2h-c28f-rfv8CGA-vjmv-57p6-9pqxCGA-xjj8-2pv5-35v4CGA-2227-hq55-rjfqCGA-2vqv-hfp8-jw5vCGA-2wmg-h9fq-8xf3CGA-2xcx-vxcg-cjf7CGA-54j4-jhrx-438xCGA-5qwc-4v5m-65p7CGA-64xf-vm4g-7p55CGA-6768-vp22-86hhCGA-6q8r-vm9v-5pxxCGA-74qr-xwr8-9xpfCGA-7gr4-2q6v-7x46CGA-7hg4-9r4r-rhgqCGA-7whw-fw8m-h6g3CGA-8xcg-fj97-27ppCGA-9228-pfhh-mhwhCGA-945q-h6gp-5848CGA-95fh-mmh9-5jjmCGA-9grf-2q36-jqfmCGA-9qqr-w7jf-vgmpCGA-9r3j-jr55-wp6fCGA-c54r-8qv8-3j6cCGA-c7wh-2wmp-9w98CGA-f8f3-p26r-773vCGA-fpf4-cv4r-h446CGA-fv86-fcrg-99cwCGA-fwp9-p7r9-mr6fCGA-g32c-wm2v-hhffCGA-jjf3-wppr-mhgfCGA-mv2m-v823-3p38CGA-p37x-8m3v-4vx2CGA-p4q6-7wg4-4pc3CGA-pp84-3256-p4mxCGA-ppm8-4898-x4qxCGA-prvj-c7hm-2324CGA-r2mf-gr5g-42j6CGA-r5gj-mxh4-7w84CGA-rvwm-xjgq-6r87CGA-w9jf-mv8v-fpw4CGA-x93p-4jmv-rpgxCGA-xpw3-rfcw-37xfCGA-27xc-mffx-gjghCGA-2cq6-88f3-7j84CGA-2jc9-vx8x-8crcCGA-38mv-f463-fxrpCGA-3g26-wr42-8v9hCGA-4jmr-x824-cxjvCGA-4wvp-2wr5-84x8CGA-4www-6x58-pjmrCGA-69v4-9h7q-p343CGA-6f26-6vc3-24j2CGA-6g7x-45cx-7q8vCGA-7v8g-7pjw-5pfcCGA-8vc8-67pq-qqx4CGA-8w7h-7268-xf2jCGA-963g-rqgq-m529CGA-f9jc-f9g3-4xm3CGA-gphw-86px-x4qcCGA-hm99-hg33-c829CGA-hprq-ppgx-hr5fCGA-jjrc-8m8m-6236CGA-jmq8-wjfw-xvr2CGA-jppm-vwg7-xhv7CGA-m53h-v53c-cv6gCGA-pphq-633x-cfwmCGA-pwrp-3gh8-v9f4CGA-qj2w-p794-grv9CGA-qv5f-q843-wrr2CGA-r948-v47c-73vjCGA-v5jm-683r-hg4jCGA-v5xp-m2mq-m284CGA-w845-9656-3qxrCGA-w9wj-4472-699gCGA-x29h-7fgh-ggggCGA-x4rx-fqg5-q7fcCGA-x55m-95fg-hh9vCGA-xg4v-fmgx-cj4rCGA-xqr7-96f8-594m
Advisory lineage Upstream: 0 Downstream: 8
Awaiting Analysis
Published: 15 Apr 2026, 09:06
Last modified:18 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.78% LOW
1% probability +0.39%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2026, 09:06
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java. This issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber
  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.78%• Percentile: 54%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

  • CWE-347•Improper Verification of Cryptographic Signature

    The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Systems

  • chainguard•apache-nifi

    < 2.9.0-r0 | < 2.9.0-r3

  • chainguard•apache-nifi-registry

    < 2.9.0-r1

  • chainguard•apache-nifi-registry-toolkit

    < 2.9.0-r1

  • chainguard•apache-pulsar-4.0

    < 4.0.9-r12

  • chainguard•apache-pulsar-4.1

    all

  • chainguard•apache-pulsar-4.2

    < 4.2.1-r0

  • chainguard•camunda-8.8

    < 8.8.22-r1

  • chainguard•camunda-8.9

    < 8.9.1-r0

  • chainguard•camunda-zeebe-8.6

    all

  • chainguard•camunda-zeebe-8.7

    < 8.7.28-r0

  • chainguard•camunda-zeebe-8.8

    < 8.8.23-r0

  • chainguard•camunda-zeebe-8.9

    < 8.9.1-r0

  • chainguard•commercial-elasticsearch-8.17

    all

  • chainguard•commercial-elasticsearch-8.18

    all

  • chainguard•commercial-elasticsearch-8.19

    < 8.19.15-r0

  • chainguard•commercial-elasticsearch-9.0

    all

  • chainguard•commercial-elasticsearch-9.1

    all

  • chainguard•commercial-elasticsearch-9.2

    all

  • chainguard•commercial-elasticsearch-9.3

    < 9.3.5-r0

  • chainguard•druid

    < 36.0.0-r15

  • chainguard•eco-java-gradle-6.0

    all

  • chainguard•eco-java-gradle-6.0.1

    all

  • chainguard•eco-java-gradle-6.1

    all

  • chainguard•eco-java-gradle-6.1.1

    all

  • chainguard•eco-java-gradle-6.2

    all

  • chainguard•eco-java-gradle-6.2.1

    all

  • chainguard•eco-java-gradle-6.2.2

    all

  • chainguard•eco-java-gradle-6.3

    all

  • chainguard•eco-java-gradle-6.4

    all

  • chainguard•eco-java-gradle-6.4.1

    all

  • chainguard•eco-java-gradle-6.5

    all

  • chainguard•eco-java-gradle-6.5.1

    all

  • chainguard•eco-java-gradle-6.6

    all

  • chainguard•eco-java-gradle-6.6.1

    all

  • chainguard•eco-java-gradle-6.7

    all

  • chainguard•eco-java-gradle-6.7.1

    all

  • chainguard•eco-java-gradle-6.8

    all

  • chainguard•eco-java-gradle-6.8.1

    all

  • chainguard•eco-java-gradle-6.8.2

    all

  • chainguard•eco-java-gradle-6.8.3

    all

  • chainguard•eco-java-gradle-6.9

    all

  • chainguard•eco-java-gradle-6.9.1

    all

  • chainguard•eco-java-gradle-6.9.2

    all

  • chainguard•eco-java-gradle-6.9.3

    all

  • chainguard•eco-java-gradle-6.9.4

    all

  • chainguard•eco-java-gradle-7.0

    all

  • chainguard•eco-java-gradle-7.0.1

    all

  • chainguard•eco-java-gradle-7.0.2

    all

  • chainguard•eco-java-gradle-7.1

    all

  • chainguard•eco-java-gradle-7.1.1

    all

Showing first 50 affected entries in server-rendered view.

References (40)