CRITICAL🇵🇱 Wersja polska

CVE-2026-8763

CVSS 9.3v4.0pub. 2026-08-03upd. 2026-09-02

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

  • Bouncycastle Bc Java

    APP
    Bouncycastle
    < 1.85

  • Bouncycastle Bouncy Castle For Java Lts

    APP
    Bouncycastle
    ≤ 2.73.11

  • Bouncycastle Fips Java Api

    APP
    Bouncycastle
    1.0.0 – 1.0.2.7 (excl.)2.0.0 – 2.0.2 (excl.)2.1.0 – 2.1.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-59638CRITICAL9.3PL ✓same product

Bouncy Castle Java: błędna weryfikacja hostname (CN-fallback) w JSSE

CVE-2026-59650CRITICAL9.3PL ✓same product

Bouncy Castle Java: brak walidacji wartości peer w protokole MTI/A0 DH

CVE-2026-58062CRITICAL9.3PL ✓same product

Bouncy Castle for Java — błędna weryfikacja OCSP (CWE-295)

CVE-2018-1000613CRITICAL9.8PL ✓same product

Niebezpieczna refleksja przy deserializacji klucza XMSS w Bouncy Castle

CVE-2026-12802HIGH8.7PL ✓same product

Bouncy Castle dla Java — brak weryfikacji tag-length w CMS AuthEnvelopedData