AIKIDO-2026-912141

bcjmail-jdk15to18 is vulnerable to Improper Certificate Validation

CVE-2026-59641Published Aug 5, 2026

CVE Score

High

Improper Certificate Validation

TL;DR

The S/MIME signed-message validator in the mail module uses the signingTime value carried inside the CMS signed attributes as the reference date for PKIX certificate path validation. Because that attribute is asserted by the message signer and is not bound to a trusted time source, a signer can supply an arbitrary time so that an expired or revoked signing certificate is treated as valid. Signed messages then pass validation against certificates that should be rejected, so SignedMailValidator reports a trusted result for messages it should refuse. The fix makes a caller-provided validation date take precedence over the signer-asserted signingTime.

How do I fix this?

Upgrade the org.bouncycastle:bcjmail-jdk15to18 library to the patch version, then set an explicit validation date on the PKIXParameters you pass to SignedMailValidator (for example the current time). Without a caller-supplied date the patched version still falls back to the signer-asserted signingTime.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use SignedMailValidator to verify S/MIME signed messages whose signingTime signed attribute is externally supplied by the message signer.