Bouncy Castle OpenPGP Cross-Certification Bypass via Missing Subkey Binding Signature (CVE-2026-71887)

Vulnerability Overview CVE ID: CVE-2026-71887 Title: OpenPGP data signature accepts self-signed subkeys without cross-certification. Description: Section 5.2.1.8 of RFC 9580 requires that the signature binding a subkey must contain an embedded signature subkey, which holds a 0x19 signature signed by the subkey, referencing the primary key and subkey ID. Additionally, Section 10.1.3 states that this is an attribute of the certificate structure. This embedded primary key binding signature (i.e., cross-certification) is the subkey’s declaration that it belongs to the primary key. If the subkey binding signature is missing, it results in a situation where: anyone can assert that the subkey on the primary key is bound, yet the requirement for its existence makes this assertion meaningless. Specific Impact: Bouncy Castle’s high-level OpenPGP API provides two inconsistent methods for reading subkeys. parses flags via and . When the subkey binding signature lacks a Key Flags subpacket, it falls back to the primary key’s direct key or user ID self-signature; thus, the subkey inherits the primary key’s SIGN_DATA flag and is counted as having signing capability. Conversely, or enforce the aforementioned requirements by reading the binding signature’s hash subpacket; if SIGN_DATA is not found, it returns the key as non-signing. However, is never thrown for subkeys missing the embedded primary key binding signature. Consequently, subkeys are treated as having signing capabilities, allowing data signatures to be attributed to the certificate, and may return true, thereby bypassing the cross-certification requirement. GnuPG rejects the same certificate and message because cross-certification was not performed. Affected Scope Platform: Java 8 and later Affected Versions: BC 1.81 prior to 1.86 Fixed Version: BC 1.86 Remediation Fixed Version: BC 1.86 Fix Commit: commit b1452f2a48 Additional Information Author: Arpan Sharma Source: https://github.com/bcgit/bc-java Code Block No POC code or exploitation code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Bouncy Castle OpenPGP Cross-Certification Bypass via Missing Subkey Binding Signature (CVE-2026-71887)

More from this source