Bouncy Castle CVE-2026-8763

Requires a relying party that uses Bouncy Castle's PKIXNameConstraintValidator (via the BC PKIX CertPathValidator or CertPathBuilder) to enforce X.509 name constraints during chain validation, and a certificate path that includes permitted/excluded subtree constraints on rfc822Name, URI, or directoryName. The attacker must be able to obtain or craft a certificate under a name-constrained issuer whose rfc822Name/URI host bears a trailing dot, or whose subject DN prepends additional RDNs before the permitted directoryName. The primary limiting factor is that the bug only has security impact where name constraints are actually depended upon for trust decisions (constrained sub-CAs, S/MIME, or GSMA SGP.22 eUICC use cases); deployments that do not use name constraints are unaffected in practice. No user interaction or authentication to the target is required (PR:N/UI:N).

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) drives the 9.3 Critical score and implies remote, unauthenticated, low-complexity exploitation with high confidentiality and integrity impact and no availability impact - consistent with an authentication/trust bypass rather than a crash. However, the network/no-privilege framing understates a key real-world precondition: exploitation only matters where a deployment actually relies on X.509 name constraints for trust decisions (e.g. constrained sub-CAs, S/MIME email trust, or GSMA SGP.22 eUICC provisioning), which is a specific rather than universal configuration. No EPSS score, KEV listing, or POC was provided, so despite the high CVSS this is best treated as a high-priority patch-soon library flaw rather than confirmed active mass exploitation. There is no conflicting data, but the absence of EPSS/KEV signals means exploitation likelihood cannot be independently quantified.

An attacker who controls or obtains a name-constrained certificate (e.g. a sub-CA permitted only for bank.com, or excluded from competitor.example) issues or presents a leaf certificate whose rfc822Name or URI host carries a trailing dot ('user@bank.com.' or 'https://competitor.example./'), or whose subject prepends attacker RDNs before a permitted directoryName. A relying Java application using BC's CertPathValidator accepts the chain because the constraint check is bypassed, letting the attacker impersonate a protected identity or domain. No public POC is currently identified, but the low attack complexity (simply appending a dot) makes weaponisation straightforward once a constrained PKI is targeted.