In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key of the third-party certificate, then verify the issuing component's binding chain and the signature itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key flag (CERTIFY_OTHER) when the signature was created. A subkey bound only with SIGN_DATA - the online signing subkey of exactly the offline-primary arrangement those key flags exist to express - could therefore issue a positive User ID certification over an attacker-controlled identity, or a full-trust depth-one direct-key delegation of introducer trust, and the API returned it as a valid signature chain attributed to the third-party certificate. An application treating getCertificationBy(...).isValid() or getDelegationBy(...) as an identity or trusted-introducer decision would attribute the attacker's assertion to the offline primary key. The same held for a legacy RSA subkey bound only for encryption, whose algorithm is nonetheless able to sign. This does not forge the primary key's signature or recover any private key; it promotes an already-compromised restricted subkey to the primary key's identity-issuing authority, defeating the containment the key-flag separation provides. A third-party certification or delegation is now attributed to the issuing certificate only when the component key that made it is the primary key, or is a subkey holding CERTIFY_OTHER when the signature was created, so certification-capable subkeys continue to be accepted; primary keys are accepted whatever their key flags say, since a primary key is certification-capable by construction and certificates carrying no key flags subpacket at all are common. Third-party revocations are deliberately outside the rule, since declining to honour one would keep trust alive rather than withdraw it.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party
    certification or trust delegation from any component key of the issuing certificate, without requiring
    that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and
    getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key
    of the third-party certificate, then verify the issuing component's binding chain and the signature
    itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key
    flag (CERTIFY_OTHER) when the signature was created. A subkey bound only with SIGN_DATA - the online
    signing subkey of exactly the offline-primary arrangement those key flags exist to express - could
    therefore issue a positive User ID certification over an attacker-controlled identity, or a full-trust
    depth-one direct-key delegation of introducer trust, and the API returned it as a valid signature chain
    attributed to the third-party certificate. An application treating getCertificationBy(...).isValid() or
    getDelegationBy(...) as an identity or trusted-introducer decision would attribute the attacker's
    assertion to the offline primary key. The same held for a legacy RSA subkey bound only for encryption,
    whose algorithm is nonetheless able to sign. This does not forge the primary key's signature or recover
    any private key; it promotes an already-compromised restricted subkey to the primary key's identity-
    issuing authority, defeating the containment the key-flag separation provides. A third-party certification
    or delegation is now attributed to the issuing certificate only when the component key that made it is the
    primary key, or is a subkey holding CERTIFY_OTHER when the signature was created, so certification-capable
    subkeys continue to be accepted; primary keys are accepted whatever their key flags say, since a primary
    key is certification-capable by construction and certificates carrying no key flags subpacket at all are
    common. Third-party revocations are deliberately outside the rule, since declining to honour one would
    keep trust alive rather than withdraw it. (CVE-2026-71886)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22169-1 advisory.

    Update to 1.86:

    - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion       (bsc#1284075).
    - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion     (bsc#1284073).
    - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing     side-channel       attacks (bsc#1284065).
    - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel     leaks       (bsc#1284205).
    - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation     and group       message interception (bsc#1284165).
    - CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust     delegations and       identity spoofing (bsc#1284212).
    - CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature     misattribution and trust       context spoofing (bsc#1284213).
    - CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause     unauthenticated attribute       injection (bsc#1284215).
    - CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name     constraint bypasses       (bsc#1284218).
    - CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member     eviction and       session takeover (bsc#1284219).
    - CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature     verification bypasses       (bsc#1284220).
    - CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses     for HKDF-derived       content keys (bsc#1284221).
    - CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered     truncation errors       and integrity check bypasses (bsc#1284222).
    - CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause     resource       exhaustion (bsc#1284224).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4797-1 advisory.

    - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion       (bsc#1284075).
    - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion     (bsc#1284073).
    - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing     side-channel       attacks (bsc#1284065).
    - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel     leaks       (bsc#1284205).
    - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identity impersonation     and group       message interception (bsc#1284165).
    - CVE-2026-71886: unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause unauthorized trust     delegations and       identity spoofing (bsc#1284212).
    - CVE-2026-71887: missing primary key back-signature validation on subkeys can cause signature     misattribution and trust       context spoofing (bsc#1284213).
    - CVE-2026-71888: disagreement between digestAlgorithm and authAttrs in CMS parsing can cause     unauthenticated attribute       injection (bsc#1284215).
    - CVE-2026-71889: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name     constraint bypasses       (bsc#1284218).
    - CVE-2026-71890: unbounded Remove proposals in external MLS commits can cause arbitrary group member     eviction and       session takeover (bsc#1284219).
    - CVE-2026-71891: forged ECPoint curves in BLS12-381 key validation can cause aggregate signature     verification bypasses       (bsc#1284220).
    - CVE-2026-71892: type mismatch in CMS key-transport validation can cause key-size enforcement bypasses     for HKDF-derived       content keys (bsc#1284221).
    - CVE-2026-85515: laundered EOF exceptions in OpenPGP message stream processing can cause unregistered     truncation errors       and integrity check bypasses (bsc#1284222).
    - CVE-2026-97873: unbounded iteration counts in legacy PBES1 and PKCS#12 PBE implementations can cause     resource       exhaustion (bsc#1284224).

    Changes for bouncycastle:

    - Updated to version 1.86.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party     certification or trust delegation from any component key of the issuing certificate, without requiring     that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and     getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key     of the third-party certificate, then verify the issuing component's binding chain and the signature     itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key     flag (CERTIFY_OTHER) when the signature was created. A subkey bound only with SIGN_DATA - the online     signing subkey of exactly the offline-primary arrangement those key flags exist to express - could     therefore issue a positive User ID certification over an attacker-controlled identity, or a full-trust     depth-one direct-key delegation of introducer trust, and the API returned it as a valid signature chain     attributed to the third-party certificate. An application treating getCertificationBy(...).isValid() or     getDelegationBy(...) as an identity or trusted-introducer decision would attribute the attacker's     assertion to the offline primary key. The same held for a legacy RSA subkey bound only for encryption,     whose algorithm is nonetheless able to sign. This does not forge the primary key's signature or recover     any private key; it promotes an already-compromised restricted subkey to the primary key's identity-     issuing authority, defeating the containment the key-flag separation provides. A third-party certification     or delegation is now attributed to the issuing certificate only when the component key that made it is the     primary key, or is a subkey holding CERTIFY_OTHER when the signature was created, so certification-capable     subkeys continue to be accepted; primary keys are accepted whatever their key flags say, since a primary     key is certification-capable by construction and certificates carrying no key flags subpacket at all are     common. Third-party revocations are deliberately outside the rule, since declining to honour one would     keep trust alive rather than withdraw it. (CVE-2026-71886)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478611	Chainguard: gradle-8: security update to 8.14.6-r5	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
478611	Chainguard: gradle-8: security update to 8.14.6-r5	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
374747	openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:22169-1)	Nessus	SuSE Local Security Checks	Local	critical
370393	SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:4797-1)	Nessus	SuSE Local Security Checks	Local	critical
362879	Linux Distros Unpatched Vulnerability : CVE-2026-71886	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-71886

high

Tenable Plugins

high

high

critical

critical

high