CVE-2026-63577: Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get certificates accepted by PKIX path validation whose subject distinguished name, or a directoryName subjectAltName, lies outside the CA's permitted subtrees, via a name that places other RDNs ahead of a copy of the permitted RDN sequence, because the check looks for the constraint's first RDN anywhere in the name and compares the remaining RDNs from that position, instead of requiring the constraint to be an initial prefix of the name as RFC 5280 sections 4.2.1.10 and 7.1 require.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0 are affected when they perform PKIX path validation involving directoryName constraints.
What does an attacker need to exploit this issue?
The attacker must control a name-constrained intermediate CA, or be able to obtain certificates from one. They can then use distinguished names that place additional RDNs before a copied permitted RDN sequence.
What is the practical security impact?
A certificate whose subject distinguished name or directoryName subjectAltName is outside the intermediate CA's permitted subtrees can be accepted by PKIX path validation. This bypasses the intended directoryName restrictions imposed on that intermediate CA.
What should be done if this affects a deployment?
Upgrade bc-csharp to version 2.7.0 or later. The affected behavior applies to versions before 2.7.0.