CVE-2026-8763: Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Published Aug 3, 2026 · Updated Sep 18, 2026
Affected packages
org.bouncycastle:bc-fips
- Ecosystem
- Maven
- Affected
- < 1.0.2.7
- Fixed in
- 1.0.2.7
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bc-fips
org.bouncycastle:bc-fips
- Ecosystem
- Maven
- Affected
- >= 2.0.0, < 2.0.2
- Fixed in
- 2.0.2
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bc-fips
org.bouncycastle:bc-fips
- Ecosystem
- Maven
- Affected
- >= 2.1.0, < 2.1.3
- Fixed in
- 2.1.3
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bc-fips
org.bouncycastle:bcprov-jdk18on
- Ecosystem
- Maven
- Affected
- < 1.85
- Fixed in
- 1.85
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bcprov-jdk18on
org.bouncycastle:bcprov-lts8on
- Ecosystem
- Maven
- Affected
- < 2.73.12
- Fixed in
- 2.73.12
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bcprov-lts8on
org.bouncycastle:bcprov-jdk15to18
- Ecosystem
- Maven
- Affected
- < 1.85
- Fixed in
- 1.85
- Check
mvn dependency:tree -Dincludes=org.bouncycastle:bcprov-jdk15to18
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-8763
- https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
- https://github.com/bcgit/bc-java/wiki/CVE-2026-8763
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
- https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
- https://github.com/advisories/GHSA-9pwp-9qqc-pr26
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology