CVE-2026-103602

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Improper certificate validation occurs in the PkixNameConstraintValidator function. An attacker controlling a name-constrained intermediate CA can cause certificates to be accepted during PKIX certification path validation for email addresses, DNS names, or URI hosts that should be excluded. This happens because the system compares names and constraints without removing the RFC 1034 root-label trailing dot, allowing a fully qualified host name to bypass an excluded subtree match. This flaw affects trust controls used in digital identity, government, and financial systems.

Recommendations Update bc-csharp to version 2.7.0 or later.