CVE-2026-8763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8763
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-8763.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-8763
Downstream
Related
Published
2026-08-03T00:36:05.088Z
Modified
2026-08-14T18:56:30.928394433Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
Name Constraints bypass via trailing dot in rfc822Name and URI
Details

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "1.0.2.7"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.2"
                },
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.1.3"
                }
            ]
        }
    ],
    "cna_assigner": "bcorg",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8763.json",
    "cwe_ids": [
        "CWE-295"
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57fbd3c501f7a369f64eda311d6a709fc0bcae84
Fixed
2c28b253a44681fbbc562561eab6ad383d2ae558
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.85"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/bcgit/bc-lts-java
Events
Introduced
468b5082f3f0971e80bf9edb7029c17b39b9ba0c
Fixed
f101b232c5d3e07ecdd504210a57e43831d6cd65
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.73.0"
        },
        {
            "fixed": "2.73.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
r1rv73
r1rv74
r1rv75
r1rv76
r1rv77
r1rv78
r1rv80
r1rv81
r1rv82
r1rv83
r1rv84
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-8763.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304363103650628069187531296260855681343",
            "length": 381.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-8763-11ed961b",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java",
            "function": "isEmailConstrained"
        },
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303362397710078105881060742045720047101",
            "length": 1821.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-8763-22e6d970",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java",
            "function": "performTest"
        },
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
    },
    {
        "deprecated": false,
        "id": "CVE-2026-8763-247b0cdb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558",
        "target": {
            "file": "prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java"
        },
        "digest": {
            "line_hashes": [
                "339522554888637023235466597182778894917",
                "230865438537172234065339755815598620516",
                "77546676416461176987863061556443598105",
                "38699607506919936379823673084619322790",
                "220257851852046584906020661054044334548",
                "160913792478439978835869647678400637428"
            ],
            "threshold": 0.9
        }
    },
    {
        "deprecated": false,
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "258644915820713060600518792126980048545",
                "271748831567274530923412762675520084565",
                "129473463621326306653182939491366498382",
                "197157627534115463247682835455538456577",
                "198405436588947468171470772436595979602",
                "223367757343591816749411703260543972616",
                "4666496785249566949753290674025735993",
                "169009403056029491551050239010880949040",
                "194067110305202858436203733035053616991",
                "168059163102669628877105587187859138427",
                "301610097998262470891609465723116817655",
                "116998896137885502641879875525647522913",
                "196700422655941162540703252537079458457",
                "265439634445662459994670351561632216818",
                "309422799987480663899594862248689331775",
                "150784441172375976330287802273262106335",
                "242302371046213258609272867095740954656",
                "96015245634354165262895406734570066179",
                "114422965707504118394064116672417071760",
                "247232533023849059765822608262098216891",
                "271263540681953062632312180662178460721",
                "156392926813749673214937625765088323745",
                "264674089870679589769710474669780857831",
                "102729771988113788244639098241274181291",
                "198007739250700078714322691196334233191",
                "77713782449582702290327661107724291659",
                "279269167979704405464477158522501367630",
                "136991901986415828787417083596147305008",
                "17229363199319834698364374683010071081",
                "163927724662747736108676831829676131511",
                "56145991924823893923373212357486314699",
                "94175063926589455396823431716665997934",
                "143303936447553289145765606595471748634",
                "136952692106539883439085990343470047446",
                "41773491531286680183789659421770112241",
                "60547983373555814867490874093202571266",
                "26866492879247903470708896920553225786",
                "217507937109672855896328931533328391908",
                "74878625971138275534642830480381676882",
                "144531890473952680815019788127665004975",
                "176651032939719295940985840618146670465"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java"
        },
        "id": "CVE-2026-8763-4741c5e9"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "51972614534984943519616746880354493013",
            "length": 185.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-8763-56e66f38",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java",
            "function": "isURIConstrained"
        },
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "14719799803116966649604235875536278249",
            "length": 1054.0
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2026-8763-7b8e50fc",
        "target": {
            "file": "core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java",
            "function": "withinDNSubtree"
        },
        "source": "https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558"
    }
]
vanir_signatures_modified 
"2026-08-12T15:42:57Z"