CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI

Description

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BC

BC-FJA · Legion of the Bouncy Castle Inc.

1.0.0 before 1.0.2.7; 2.0.0 before 2.0.2; 2.1.0 before 2.1.3 · source: vendor

BC

BC-JAVA · Legion of the Bouncy Castle Inc.

before 1.85 · source: vendor, NVD

BC

BC-LTS-JAVA · Legion of the Bouncy Castle Inc.

2.73.0 before 2.73.12 · source: vendor

BC

Bouncy Castle For Java Lts · Bouncycastle

through 2.73.11 · source: NVD

FJ

Fips Java Api · Bouncycastle

1.0.0 before 1.0.2.7; 2.0.0 before 2.0.2; 2.1.0 before 2.1.3 · source: NVD