CVE-2026-59643

Red Hat statement

This flaw has an Important impact. Bouncy Castle for Java's OpenPGP (bcpg) module silently ignores inline-signature policy failures instead of reporting them to the application. When an application processes OpenPGP-signed data with signature policy constraints, policy violations are not enforced or reported. A remote attacker can exploit this by sending OpenPGP-signed data that violates signature policies. The application will process the data as if the signature policy was satisfied, leading to acceptance of maliciously altered or unauthorized data. This affects applications using Bouncy Castle's bcpg module for OpenPGP signature verification with policy enforcement.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.