~ / search / GHSA-9pwp-9qqc-pr26

GHSA-9pwp-9qqc-pr26

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-8763

Packages

EcosystemPackageAffectedFixed in
Maven org.bouncycastle:bc-fips < 1.0.2.7 1.0.2.7
Maven org.bouncycastle:bc-fips >= 2.0.0, < 2.0.2 2.0.2
Maven org.bouncycastle:bc-fips >= 2.1.0, < 2.1.3 2.1.3
Maven org.bouncycastle:bcprov-jdk18on < 1.85 1.85
Maven org.bouncycastle:bcprov-lts8on < 2.73.12 2.73.12
Maven org.bouncycastle:bcprov-jdk15to18 < 1.85 1.85

Details

As written in the advisory (Markdown source, shown as plain text).

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

References

External links from the advisory. They lead to third-party sites.