CVE-2026-63576

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Improper certificate validation occurs in the PkixNameConstraintValidator (specifically within the ExtractHostFromURL function). This issue allows a name-constrained subordinate CA, or an entity capable of obtaining certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation. The flaw exists because the host is extracted using string slicing without first isolating the RFC 3986 authority component. Consequently, if a URI's path, query, fragment, or userinfo contains characters such as '@' or ':', the host compared against the constraints may differ from the actual host of the URI.

Recommendations Update bc-csharp to version 2.7.0 or later.