Skip to content

CVE‐2026‐5588

David Hook edited this page Apr 15, 2026 · 6 revisions

Title: PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Issue affecting: BC 1.67 to 1.83.

Fixed versions: BC 1.84

Platform affected: Java 4 and later.

Clone this wiki locally