{"id":"CVE-2026-8763","summary":"Name Constraints bypass via trailing dot in rfc822Name and URI","details":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).","modified":"2026-08-14T18:56:30.928394433Z","published":"2026-08-03T00:36:05.088Z","related":["SUSE-SU-2026:23127-1","SUSE-SU-2026:23150-1","SUSE-SU-2026:3559-1","openSUSE-SU-2026:11445-1","openSUSE-SU-2026:21538-1"],"database_specific":{"cna_assigner":"bcorg","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8763.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.0.2.7"},{"introduced":"2.0.0"},{"fixed":"2.0.2"},{"introduced":"2.1.0"},{"fixed":"2.1.3"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-fips/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java-lts/"},{"type":"WEB","url":"https://www.bouncycastle.org/download/bouncy-castle-java/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8763.json"},{"type":"ADVISORY","url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763"},{"type":"FIX","url":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-java"},{"type":"PACKAGE","url":"https://github.com/bcgit/bc-lts-java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bcgit/bc-java","events":[{"introduced":"0"},{"fixed":"57fbd3c501f7a369f64eda311d6a709fc0bcae84"},{"fixed":"2c28b253a44681fbbc562561eab6ad383d2ae558"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.85"}],"source":["DESCRIPTION","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/bcgit/bc-lts-java","events":[{"introduced":"468b5082f3f0971e80bf9edb7029c17b39b9ba0c"},{"fixed":"f101b232c5d3e07ecdd504210a57e43831d6cd65"}],"database_specific":{"extracted_events":[{"introduced":"2.73.0"},{"fixed":"2.73.12"}],"source":"AFFECTED_FIELD"}}],"versions":["r1rv84","r1rv81","r1rv83","r1rv82","r1rv80","r1rv78","r1rv77","r1rv76","r1rv75","r1rv74","r1rv73","r2rv73dot11","r2rv73dot10","r2rv73dot9","r2rv73dot8","r2rv73dot6","r2rv73dot4","r2rv73dot3","r2rv73dot1","r2rv73dot0"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","target":{"file":"core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java","function":"isEmailConstrained"},"deprecated":false,"digest":{"function_hash":"304363103650628069187531296260855681343","length":381},"id":"CVE-2026-8763-11ed961b","signature_type":"Function"},{"digest":{"length":1821,"function_hash":"303362397710078105881060742045720047101"},"id":"CVE-2026-8763-22e6d970","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","target":{"function":"performTest","file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java"},"deprecated":false},{"target":{"file":"prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java"},"deprecated":false,"digest":{"line_hashes":["339522554888637023235466597182778894917","230865438537172234065339755815598620516","77546676416461176987863061556443598105","38699607506919936379823673084619322790","220257851852046584906020661054044334548","160913792478439978835869647678400637428"],"threshold":0.9},"id":"CVE-2026-8763-247b0cdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"},{"source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","target":{"file":"core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["258644915820713060600518792126980048545","271748831567274530923412762675520084565","129473463621326306653182939491366498382","197157627534115463247682835455538456577","198405436588947468171470772436595979602","223367757343591816749411703260543972616","4666496785249566949753290674025735993","169009403056029491551050239010880949040","194067110305202858436203733035053616991","168059163102669628877105587187859138427","301610097998262470891609465723116817655","116998896137885502641879875525647522913","196700422655941162540703252537079458457","265439634445662459994670351561632216818","309422799987480663899594862248689331775","150784441172375976330287802273262106335","242302371046213258609272867095740954656","96015245634354165262895406734570066179","114422965707504118394064116672417071760","247232533023849059765822608262098216891","271263540681953062632312180662178460721","156392926813749673214937625765088323745","264674089870679589769710474669780857831","102729771988113788244639098241274181291","198007739250700078714322691196334233191","77713782449582702290327661107724291659","279269167979704405464477158522501367630","136991901986415828787417083596147305008","17229363199319834698364374683010071081","163927724662747736108676831829676131511","56145991924823893923373212357486314699","94175063926589455396823431716665997934","143303936447553289145765606595471748634","136952692106539883439085990343470047446","41773491531286680183789659421770112241","60547983373555814867490874093202571266","26866492879247903470708896920553225786","217507937109672855896328931533328391908","74878625971138275534642830480381676882","144531890473952680815019788127665004975","176651032939719295940985840618146670465"]},"id":"CVE-2026-8763-4741c5e9","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"51972614534984943519616746880354493013","length":185},"id":"CVE-2026-8763-56e66f38","signature_type":"Function","signature_version":"v1","source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","target":{"function":"isURIConstrained","file":"core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java"},"deprecated":false},{"source":"https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","target":{"file":"core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java","function":"withinDNSubtree"},"deprecated":false,"digest":{"length":1054,"function_hash":"14719799803116966649604235875536278249"},"id":"CVE-2026-8763-7b8e50fc","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-8763.json","vanir_signatures_modified":"2026-08-12T15:42:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber"}]}