This vulnerability (CVE-2026-59643) affects Bouncy Castle for Java versions 1.81 up to but not including 1.85, and BC-FJA versions before bcpg-fips 2.0.13. The flaw is categorized under CWE-347, indicating improper verification of cryptographic signatures. Specifically, OpenPGP inline-signature policy failures are silently ignored, which means that signature verification failures do not trigger expected error handling. This could lead to acceptance of invalid signatures without detection, compromising the integrity and authenticity guarantees of cryptographic operations relying on this library.

The impact of this vulnerability is significant as it undermines the cryptographic signature verification process. Applications using affected versions of BC-JAVA or BC-FJA may incorrectly accept invalid or tampered signatures, potentially allowing attackers to bypass security controls that rely on signature validation. This could lead to unauthorized data acceptance or execution of maliciously altered content. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users of affected versions (1.81 through before 1.85) should monitor the vendor's communications for updates and consider upgrading to versions at or beyond 1.85 once a fix is released. Until then, avoid using affected versions in security-critical contexts where signature verification is essential.