CLEANSTART-2026-SJ77898 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

CVE-2026-27138 affects multiple packages. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. See references for individual vulnerability details...

CLEANSTART-2026-NA69133 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

Security vulnerability affects the temporal-server package. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints...

CVE-2026-71889

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

DEBIAN-CVE-2026-71889

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

UBUNTU-CVE-2026-71889

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

EUVD-2026-91990

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889

Bouncy Castle for Java contains a vulnerability where the PKIXCertPathReviewer (both org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and the legacy org.bouncycastle.x509.PKIXCertPathReviewer) fails to apply X.509 name constraints to the end-entity certificate. The root cause is that checkNameCo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-71889: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

PT-2026-104562

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Bouncy Castle for Java LTS versions prior to 2.73.13 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 2.0.13...

Linux Distros Unpatched Vulnerability : CVE-2026-71889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy...

CVE-2026-63576

Improper certificate validation in PkixNameConstraintValidator ExtractHostFromURL in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or...

CVE-2026-103602 Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...

CVE-2026-103602 Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...

CVE-2026-63577 Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

Improper certificate validation in the directoryName name-constraint check PkixNameConstraintValidator.WithinDNSubtree in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get...

CVE-2026-63577 Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

Improper certificate validation in the directoryName name-constraint check PkixNameConstraintValidator.WithinDNSubtree in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get...

CVE-2026-63577 Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

Improper certificate validation in the directoryName name-constraint check PkixNameConstraintValidator.WithinDNSubtree in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get...