GitHub Advisoryadvisory · Maven

GHSA-9pwp-9qqc-pr26 Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

CRITICAL Published 2026-08-03 Modified 2026-09-18 Official page ↗
Aliases
CVE-2026-8763
Ecosystem
Maven
Packages
org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-lts8on, org.bouncycastle:bcprov-jdk15to18
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-09-18

Affected packages

• Maven org.bouncycastle:bc-fips: < 1.0.2.7 → fixed in 1.0.2.7 • Maven org.bouncycastle:bc-fips: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • Maven org.bouncycastle:bc-fips: >= 2.1.0, < 2.1.3 → fixed in 2.1.3 • Maven org.bouncycastle:bcprov-jdk18on: < 1.85 → fixed in 1.85 • Maven org.bouncycastle:bcprov-lts8on: < 2.73.12 → fixed in 2.73.12 • Maven org.bouncycastle:bcprov-jdk15to18: < 1.85 → fixed in 1.85

Description

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Related

Alias · CVE (1)

  • CVE-2026-8763 In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References