CVE-2026-103602: Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation for email addresses, DNS names or URI hosts that lie within excluded subtrees applying to that CA, via an rfc822Name, dNSName or uniformResourceIdentifier name whose host ends with a dot, because names and constraints were compared without first removing the RFC 1034 root-label trailing dot, so a fully qualified host name did not match an excluded subtree for the same host written without the dot.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using bc-csharp before 2.7.0 for PKIX certification path validation are exposed when they validate certificates chaining through a name-constrained intermediate CA. The practical impact applies where excluded name subtrees are relied on to prevent use of particular email domains, DNS names, or URI hosts.
What does an attacker need to exploit it?
An attacker must control, or be able to obtain certificates from, a name-constrained intermediate CA. They can use a trailing dot in an rfc822Name, dNSName, or URI host so that a host within an excluded subtree may not match the equivalent exclusion written without the trailing dot.
What versions are affected and what is the remediation?
bc-csharp versions before 2.7.0 are affected. Upgrade to version 2.7.0 or later.
How can I identify potentially affected certificate usage?
Review certificate-validation paths that use name-constrained intermediate CAs and enforce excluded subtrees. Look for certificates containing email addresses, DNS names, or URI hosts with a trailing dot, particularly where the same hostname is excluded without a trailing dot.