CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8763?
CVE-2026-8763 has a risk rating of 53.
How do I fix CVE-2026-8763?
To fix CVE-2026-8763, update to Bouncy Castle for Java version 1.85 or later, or to the respective fixed versions for LTS and FIPS.
What products are affected by CVE-2026-8763?
CVE-2026-8763 affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS (BC-FJA) versions prior to their respective fixed releases.
What kind of vulnerability is CVE-2026-8763?
CVE-2026-8763 is a Name Constraints bypass vulnerability that can be exploited via trailing dots in rfc822Name and URI.
When was CVE-2026-8763 published?
CVE-2026-8763 was published on August 3, 2026.