The vulnerability CVE-2026-5588 in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix arises because the PKIX draft CompositeVerifier implementation accepts an empty signature sequence as valid. This improper verification allows an attacker to submit a crafted payload with an empty signature sequence that bypasses cryptographic signature checks, undermining the authenticity and integrity of data validated by the CompositeVerifier. The issue affects BC-JAVA versions from 1.67 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84; BCPKIX-FIPS from 2.0.6 before 2.0.11 and from 2.1.7 before 2.1.11; and BCPIX-LTS from 2.73.7 before 2.73.11. Red Hat has issued a security advisory and released updates in JBoss Enterprise Application Platform 8.1.6 to fix this vulnerability. The mitigation involves checking for and rejecting empty signature sequences prior to cryptographic validation.

The vulnerability allows remote attackers to bypass signature verification mechanisms by submitting an empty signature sequence, which the CompositeVerifier incorrectly accepts as valid. This compromises the authenticity and integrity of data, enabling attackers to forge digital signatures and impersonate trusted entities. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

A security update fixing this vulnerability is available and has been released by Red Hat in JBoss Enterprise Application Platform 8.1.6. Users should apply this update to remediate the issue. Additionally, applications should implement checks to ensure that signature sequences are not empty before passing data to the CompositeVerifier. If an empty or null signature sequence is detected, the payload should be explicitly rejected to prevent bypass of signature verification.