PT-2026-67343 · Legion Of The Bouncy Castle · Bc-Fja+2

CVE-2026-8763 · Published 2026-08-03 · Updated 2026-08-03

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-8763

Affected Products

Bc-Fja

Bc-Java

Bc-Lts-Java

References · 4

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2026-8763 · Exploit
• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763 · Exploit
• https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8763 · Security Note