This vulnerability (CVE-2026-5588) in Legion of the Bouncy Castle Inc. BC-JAVA PKIX modules arises from the PKIX draft CompositeVerifier accepting an empty signature sequence as valid, which constitutes the use of a broken or risky cryptographic algorithm (CWE-327). The affected components include BC-JAVA (versions from 1.67 before 1.80.2, from 1.81 before 1.81.1, and from 1.82 before 1.84), BCPKIX-FIPS (from 2.0.6 before 2.0.11, and from 2.1.7 before 2.1.11), and BCPIX-LTS (from 2.73.7 before 2.73.11). Red Hat advisories confirm the vulnerability and provide security updates for affected products such as Red Hat JBoss Enterprise Application Platform 8.1.6. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack complexity, no privileges required, no user interaction, low confidentiality impact, and no impact on integrity or availability.

The vulnerability allows acceptance of an empty signature sequence as valid in cryptographic verification, potentially undermining the integrity checks performed by the PKIX modules. This could lead to acceptance of invalid or maliciously crafted signatures, weakening cryptographic assurances. The CVSS score of 6.3 (medium severity) reflects a moderate risk with network attack vector and no required privileges or user interaction. There are no known exploits in the wild at this time.

Security updates addressing CVE-2026-5588 have been released by Red Hat and are available in Red Hat JBoss Enterprise Application Platform 8.1.6 and related packages. Users should apply these official patches to remediate the vulnerability. The vendor advisory URLs provided contain detailed instructions and errata for updating affected systems. Patch status is confirmed by Red Hat advisories; therefore, applying the vendor-provided updates is the recommended mitigation.