Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

🗓️ 03 Aug 2026 03:31:56Reported by GitHub Advisory DatabaseType

Bouncy Castle for Java before 1.85 Name Constraints bypass via trailing dot in rfc822Name and URI.

Reporter	Title	Published	Views	Family All 481
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle	15 Sep 202604:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:57	–	ibm
attackerkb	CVE-2026-8763	3 Aug 202600:36	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-2153)	14 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (openSUSE-SU-2026:21538-1)	8 Aug 202600:00	–	nessus
Tenable Nessus	SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:3559-1)	12 Aug 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-8763	3 Aug 202600:00	–	nessus
Amazon	Important: bouncycastle	14 Sep 202600:00	–	amazon
Chainguard	CVE-2026-8763 vulnerabilities	5 Aug 202620:22	–	cgr

Vulners

Node

org.bouncycastle bc-fipsRange2.1.0–2.1.3maven

org.bouncycastle bc-fipsRange2.0.0–2.0.2maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-8763
github	www.github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
github	www.github.com/bcgit/bc-java/wiki/CVE-2026-8763
github	www.github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
github	www.github.com/bcgit/bc-java/releases/tag/r1rv85v2
github	www.github.com/advisories/GHSA-9pwp-9qqc-pr26

18 Sep 2026 17:36Current

CVSS 3.19.1

CVSS 49.3

EPSS0.0043

SSVC