CVE-2026-63577: Bouncy Castle Certificate Validation Flaw

CVE-2026-63577 Overview

CVE-2026-63577 is an improper certificate validation flaw [CWE-295] in the Legion of the Bouncy Castle bc-csharp library before version 2.7.0. The defect lives in PkixNameConstraintValidator.WithinDNSubtree, which enforces X.509 directoryName name constraints during PKIX path validation. The validator searches for the constraint's first Relative Distinguished Name (RDN) anywhere within the subject name rather than requiring it as an initial prefix, as mandated by RFC 5280 sections 4.2.1.10 and 7.1. An attacker who controls a name-constrained intermediate Certificate Authority (CA) can craft certificates whose subject DN or directoryName subjectAltName falls outside the CA's permitted subtrees yet still passes validation.

Critical Impact
A malicious or compromised subordinate CA can issue certificates for identities outside its authorized namespace, defeating the primary security control that constrains delegated issuance authority.

Affected Products

Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0
.NET applications performing PKIX path validation via Bouncy Castle C#
Systems relying on directoryName name constraints to scope intermediate CAs

Discovery Timeline

2026-10-02 - CVE-2026-63577 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-63577

Vulnerability Analysis

X.509 name constraints allow a parent CA to restrict a subordinate CA to issuing certificates only within specific namespaces. For directoryName constraints, RFC 5280 requires that the permitted subtree form an initial prefix of the subject's Distinguished Name sequence of RDNs. The flawed WithinDNSubtree implementation in bc-csharp instead scans for the constraint's first RDN at any position in the subject name and then compares subsequent RDNs starting from that offset. This permits a crafted subject such as CN=victim.example.com, OU=Attacker, O=Permitted-Org, C=US to satisfy a constraint rooted at O=Permitted-Org, C=US even though additional attacker-controlled RDNs appear ahead of the permitted sequence.

Root Cause

The root cause is a logic error in prefix matching. The validator treats the permitted subtree as a substring search target rather than an anchored prefix. Any name containing the permitted RDN sequence at an arbitrary position passes the check, so attackers can prepend arbitrary RDNs including a spoofed CN.

Attack Vector

Exploitation requires control of, or the ability to request certificates from, an intermediate CA that is constrained by a directoryName permitted subtree. The attacker requests a certificate whose subject DN or directoryName subjectAltName places other RDNs ahead of a copy of the permitted RDN sequence. Relying parties using vulnerable bc-csharp versions accept the certificate as valid, enabling impersonation of identities outside the subordinate CA's permitted namespace. The attack is network-reachable and requires no user interaction.

text

// Patch excerpt from crypto/src/util/Properties.cs introducing an opt-in
// property for the relaxed SGP.22 matching behavior. BC default validation
// remains RFC 5280 strict after the fix.

public static readonly string X509MaxPolicyNodes = "Org.BouncyCastle.X509.MaxPolicyNodes";

/// <summary>
/// Opt in to the relaxed directoryName name-constraint matching required by GSMA SGP.22 v2.5 (Remote SIM
/// Provisioning), sections 4.5.2.1.0.2 / 4.5.2.1.0.3. When set, a permitted-subtree RDN is satisfied by any
/// matching subject RDN regardless of position, additional subject attributes beyond those named in the subtree
/// are tolerated, and a serialNumber RDN is matched with a StartsWith comparison wherever it appears.
/// This is deliberately looser than the contiguous-prefix DN matching mandated by RFC 5280 7.1, so it defaults
/// to off and must be enabled explicitly; BC's default validation remains RFC 5280 strict.
/// </summary>
public static readonly string X509Sgp22NameConstraints = "Org.BouncyCastle.X509.Sgp22NameConstraints";

Source: GitHub Commit 606e9153

Detection Methods for CVE-2026-63577

Indicators of Compromise

Certificates presenting a subject DN or directoryName subjectAltName where RDNs appear ahead of a known permitted-subtree RDN sequence from a constrained intermediate CA.
Successful TLS or signature validations against identities that fall outside a subordinate CA's documented namespace.
Audit logs showing acceptance of certificates whose issuer is a name-constrained CA but whose subject does not share the expected RDN prefix.

Detection Strategies

Inventory .NET applications and dependencies for BouncyCastle.Cryptography or BouncyCastle NuGet packages at versions below 2.7.0.
Perform offline re-validation of recently accepted certificate chains using a patched validator and flag any chain that fails the stricter RFC 5280 prefix check.
Compare subject DN structures of certificates issued by known constrained intermediates against the declared permitted subtree in the issuing CA certificate.

Monitoring Recommendations

Enable PKIX path validation diagnostic logging where available and alert on anomalous RDN ordering in accepted chains.
Monitor certificate transparency feeds for issuance by constrained intermediates where subject DNs contain unexpected leading RDNs.
Track dependency manifests (packages.lock.json, *.csproj) in CI pipelines to detect reintroduction of vulnerable bc-csharp versions.

How to Mitigate CVE-2026-63577

Immediate Actions Required

Upgrade bc-csharp to version 2.7.0 or later in all affected .NET projects and rebuild dependent applications.
Audit trust stores and remove or re-scope any intermediate CAs whose issuance authority was presumed to be limited by directoryName constraints.
Re-validate previously issued end-entity certificates from constrained intermediates to confirm their subject DNs satisfy anchored-prefix matching.

Patch Information

The fix is tracked in the upstream project. Review the vendor advisory at GitHub CVE-2026-63577 Details and the corrective commits 606e9153 and 75c3c576. Default validation after 2.7.0 enforces RFC 5280 contiguous-prefix DN matching; the relaxed SGP.22 behavior is available only as an explicit opt-in via the Org.BouncyCastle.X509.Sgp22NameConstraints property.

Workarounds

Where upgrade is not immediately feasible, remove reliance on directoryName name constraints and instead constrain subordinate CAs with explicitly permitted DNS or URI subtrees that are correctly enforced.
Pin trusted end-entity certificates or restrict trust anchors to issuers that do not depend on directoryName subtree enforcement.
Do not enable the X509Sgp22NameConstraints opt-in property unless specifically required for GSMA SGP.22 Remote SIM Provisioning compliance.

bash

# Upgrade the Bouncy Castle C# package to the patched release
dotnet add package BouncyCastle.Cryptography --version 2.7.0

# Verify the resolved version across the solution
dotnet list package --include-transitive | grep -i bouncycastle