Search: CVE-2026-71887

CVE-2026-71887 is a vulnerability in Bouncy Castle for Java (BC-JAVA) versions 1.81 up to but not including 1.86. The high-level OpenPGP API improperly verifies cryptographic signatures by accepting a signing subkey that lacks the required embedded Primary Key Binding signature in its Subkey Binding signature, violating RFC 9580 requirements. This flaw allows an attacker to misattribute a genuine signature made by the victim's public signing subkey to an attacker-chosen identity, without forging a new signature or recovering private keys. The issue is fixed in version 1.86.