{"id":"CVE-2026-8763","revision":"a32469b39cf14ae4ae7396dfc0d83793","records":[{"revision":"a32469b39cf14ae4ae7396dfc0d83793","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-8763","aliases":[],"title":"Name Constraints bypass via trailing dot in rfc822Name and URI","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).","state":0,"publishedAt":"2026-08-03T00:36:05.088+00:00","modifiedAt":"2026-10-05T01:16:57.817+00:00","affected":[{"ecosystem":"https://www.bouncycastle.org/download/bouncy-castle-java/","name":"bcprov","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Legion of the Bouncy Castle Inc.\",\n                    \"product\": \"BC-JAVA\",\n                    \"platforms\": [\n                        \"all\"\n                    ],\n                    \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java/\",\n                    \"packageName\": \"bcprov\",\n                    \"repo\": \"https://github.com/bcgit/bc-java\",\n                    \"packageURL\": \"pkg:maven/org.bouncycastle/bcprov-jdk18on\",\n                    \"modules\": [\n                        \"core\"\n                    ],\n                    \"programFiles\": [\n                        \"PKIXNameConstraintValidator\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.85\",\n                            \"versionType\": \"maven\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/","name":"bcprov-lts8on","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Legion of the Bouncy Castle Inc.\",\n                    \"product\": \"BC-LTS-JAVA\",\n                    \"platforms\": [\n                        \"all\"\n                    ],\n                    \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java-lts/\",\n                    \"packageName\": \"bcprov-lts8on\",\n                    \"repo\": \"https://github.com/bcgit/bc-lts-java\",\n                    \"packageURL\": \"pkg:maven/org.bouncycastle/bcprov-lts8on\",\n                    \"modules\": [\n                        \"core\"\n                    ],\n                    \"programFiles\": [\n                        \"PKIXNameConstraintValidator\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.73.0\",\n                            \"lessThan\": \"2.73.12\",\n                            \"versionType\": \"maven\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/","name":"bc-fips","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Legion of the Bouncy Castle Inc.\",\n                    \"product\": \"BC-FJA\",\n                    \"platforms\": [\n                        \"all\"\n                    ],\n                    \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java-fips/\",\n                    \"packageName\": \"bc-fips\",\n                    \"packageURL\": \"pkg:maven/org.bouncycastle/bc-fips\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.0.0\",\n                            \"lessThan\": \"1.0.2.7\",\n                            \"versionType\": \"maven\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.0.0\",\n                            \"lessThan\": \"2.0.2\",\n                            \"versionType\": \"maven\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.1.0\",\n                            \"lessThan\": \"2.1.3\",\n                            \"versionType\": \"maven\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-8763","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-8763","identifiers":["CVE-2026-8763"]},"retained":false,"historicalAffected":[]}],"coverage":[]}