CVE-2026-71889Published
PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
cve-program · CVE-2026-71889
Publishedbcpkix
https://www.bouncycastle.org/download/bouncy-castle-java/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Legion of the Bouncy Castle Inc.",
"product": "BC-JAVA",
"platforms": [
"all"
],
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
"packageName": "bcpkix",
"repo": "https://github.com/bcgit/bc-java",
"packageURL": "pkg:maven/org.bouncycastle/bcpkix-jdk18on",
"modules": [
"pkix"
],
"programFiles": [
"PKIXCertPathReviewer"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.86",
"versionType": "maven"
}
],
"defaultStatus": "unaffected"
}bcprov
https://www.bouncycastle.org/download/bouncy-castle-java/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Legion of the Bouncy Castle Inc.",
"product": "BC-JAVA",
"platforms": [
"all"
],
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
"packageName": "bcprov",
"repo": "https://github.com/bcgit/bc-java",
"packageURL": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
"modules": [
"prov"
],
"programFiles": [
"PKIXCertPathReviewer"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.86",
"versionType": "maven"
}
],
"defaultStatus": "unaffected"
}bcpkix-lts8on
https://www.bouncycastle.org/download/bouncy-castle-java-lts/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Legion of the Bouncy Castle Inc.",
"product": "BC-LTS-JAVA",
"platforms": [
"all"
],
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-lts/",
"packageName": "bcpkix-lts8on",
"repo": "https://github.com/bcgit/bc-lts-java",
"packageURL": "pkg:maven/org.bouncycastle/bcpkix-lts8on",
"modules": [
"pkix"
],
"programFiles": [
"PKIXCertPathReviewer"
],
"versions": [
{
"status": "affected",
"version": "2.73.0",
"lessThan": "2.73.13",
"versionType": "maven"
}
],
"defaultStatus": "unaffected"
}bcpkix-fips
https://www.bouncycastle.org/download/bouncy-castle-java-fips/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Legion of the Bouncy Castle Inc.",
"product": "BC-FJA",
"platforms": [
"all"
],
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java-fips/",
"packageName": "bcpkix-fips",
"packageURL": "pkg:maven/org.bouncycastle/bcpkix-fips",
"versions": [
{
"status": "affected",
"version": "1.0.4",
"lessThan": "1.0.13",
"versionType": "maven"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.13",
"versionType": "maven"
},
{
"status": "affected",
"version": "2.1.0",
"lessThan": "2.1.13",
"versionType": "maven"
}
],
"defaultStatus": "unaffected"
}Original source record · Cite this exact observation · Complete original publisher JSON