CVE-2026-8763CWE-295

CVE-2026-8763

Critical · published August 3, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-08-03T05:16Z
Affected products (5)
ProductVersionsFixed in
bouncycastle/bc-java< 1.851.85
bouncycastle/bouncy_castle_for_java_lts≤ 2.73.11—
bouncycastle/fips_java_api≥ 1.0.0, < 1.0.2.71.0.2.7
bouncycastle/fips_java_api≥ 2.0.0, < 2.0.22.0.2
bouncycastle/fips_java_api≥ 2.1.0, < 2.1.32.1.3
References (2)
https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558 · 91579145-5d7b-4cc5-b925-a0262ff19630https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763 · 91579145-5d7b-4cc5-b925-a0262ff19630
EPSS history
Timeline
  • 03 AUG 00:36Z
    Name Constraints bypass via trailing dot in rfc822Name and URI
    cvelistv5