CVE-2026-8763

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.0.2 Bouncy Castle for Java FIPS (BC-FJA) versions prior to 2.1.3

Description A Name Constraints bypass exists when a trailing dot is used in rfc822Name and URI. Name Constraints are a mechanism used in certificates to restrict the scope of names for which a Certificate Authority is trusted to issue certificates.

Recommendations Update Bouncy Castle for Java to version 1.85 or later. Update Bouncy Castle for Java LTS to version 2.73.12 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 1.0.X series to version 1.0.2.7 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.0.X series to version 2.0.2 or later. Update Bouncy Castle for Java FIPS (BC-FJA) 2.1.X series to version 2.1.3 or later.