CVE-2026-8763

Published: Aug 3, 2026Modified: Sep 2, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberShow less

Source: 91579145-5d7b-4cc5-b925-a0262ff19630 (Secondary)

Description

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Affected (5)

Products: Bouncycastle: Bc Java, Bouncy Castle For Java Lts, Fips Java Api

Bouncycastle

3 products

Bc Java

Bouncy Castle For Java Lts

Fips Java Api

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Before 1.85
Bouncycastle Bouncy Castle For Java Lts	Up to 2.73.11
Bouncycastle Fips Java Api	From 1.0.0 to 1.0.2.7
Bouncycastle Fips Java Api	From 2.0.0 to 2.0.2
Bouncycastle Fips Java Api	From 2.1.0 to 2.1.3

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Patch

https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763

Source: 91579145-5d7b-4cc5-b925-a0262ff19630

Third Party AdvisoryPatch

Timeline

No history available yet.