CVE‐2026‐5588

Title: PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Issue affecting: BC 1.67 to 1.80.1, BC 1.81, BC 1.82 to BC 1.83. BCPKIX-FIPS 2.0.6 to 2.0.10. BCPKIX-FIPS 2.1.7 to 2.1.10. BCPKIX-LTS 2.73.7 to 2.73.10

Fixed versions: BC 1.80.2, BC 1.81.1, BC 1.84, BCPKIX-FIPS 2.0.11, BCPKIX-FIPS 2.1.11, BCPKIX-LTS 2.73.11

Platform affected: Java 4 and later.

The test OID for the early draft of the COMPOSITE signature type would accept an empty signature and treat it as valid. The patch enforces a check to ensure at least one signature has been validated.

The fix was introduced in commit 656bae0dbd9b1521f840521ff786e78749fe3057