CVE-2026-8763: Bouncy Castle Auth Bypass Vulnerability

CVE-2026-8763 Overview

CVE-2026-8763 is a certificate validation flaw [CWE-295] in Bouncy Castle for Java. The library fails to correctly enforce X.509 Name Constraints when processing rfc822Name and URI general names containing a trailing dot. Attackers can craft certificates that bypass permittedSubtrees and excludedSubtrees restrictions defined by intermediate certificate authorities. The issue also affects directoryName prefix handling within the PKIXNameConstraintValidator. Applications relying on Bouncy Castle for X.509 path validation may accept certificates that should be rejected under RFC 5280.

Critical Impact
A malicious certificate can bypass Name Constraints and be validated as trusted, enabling impersonation of protected domains, email addresses, and URIs across TLS, S/MIME, and code signing use cases.

Affected Products

Bouncy Castle for Java before 1.85
Bouncy Castle for Java LTS before 2.73.12
Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7, 2.0.2, and 2.1.3

Discovery Timeline

2026-08-03 - CVE-2026-8763 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-8763

Vulnerability Analysis

Bouncy Castle enforces X.509 Name Constraints through the PKIXNameConstraintValidator class. The validator compares subject alternative names in an end-entity certificate against permitted and excluded subtrees declared by an issuing CA. Two distinct flaws combine under this CVE.

The first flaw involves rfc822Name (email) and uniformResourceIdentifier general names. A trailing dot appended to the hostname portion, such as user@example.com. or https://example.com./path, is not normalized before comparison against the constraint. As a result, a name that logically resolves to the constrained domain is treated as outside the constrained subtree.

The second flaw involves directoryName matching. The prior implementation searched for the constraint's first Relative Distinguished Name (RDN) at any offset within the subject's RDN sequence. An attacker could prepend arbitrary RDNs ahead of a permitted sequence and still satisfy the check.

Root Cause

The root cause is improper certificate validation [CWE-295]. RFC 5280 §4.2.1.10 requires that a directoryName constraint be an initial prefix of the subject's RDN sequence, and that DNS-style name forms be canonicalized before comparison. Bouncy Castle allowed anywhere-matching for directory names and did not strip the trailing label separator from rfc822Name and URI host components.

Attack Vector

An attacker who obtains a subordinate certificate from a CA that issued a name-constrained intermediate can request certificates for identities outside the permitted subtree. When a relying party validates the chain with a vulnerable Bouncy Castle version, the crafted certificate passes validation. The attack is remote and requires no authentication or user interaction.

java

// Patch excerpt: core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java
// RFC 5280 4.2.1.10 / 7.1: a directoryName constraint is satisfied only when the constraint's
// RDNSequence is an initial prefix of the subject's. Match from index 0 only - searching for
// the constraint's first RDN at an arbitrary offset let an attacker prepend RDNs ahead of the
// permitted sequence (e.g. a subject C=FR,O=Attacker,C=US,O=TrustedOrg,CN=x being judged
// inside permitted subtree C=US,O=TrustedOrg) and still pass the permittedSubtrees check.
int start = 0;

for (int j = 0; j < subtree.size(); j++)
{
    // strict initial-prefix comparison follows
}

Source: Bouncy Castle patch commit 2c28b25

Detection Methods for CVE-2026-8763

Indicators of Compromise

Presence of bcprov-jdk*.jar files with versions below 1.85 on Java application servers
X.509 certificates carrying rfc822Name or uniformResourceIdentifier SAN values ending with a trailing dot in the host component
End-entity certificates whose subject DN contains RDNs that prepend additional components before a name-constrained CA's permitted subtree

Detection Strategies

Inventory all Java runtimes and applications, then match embedded Bouncy Castle JAR versions against the fixed versions listed in the vendor advisory
Parse TLS and S/MIME certificate logs to flag SANs where the DNS or email host label terminates with .
Audit certificate chains validated by internal PKI monitoring tools for name constraint violations against RFC 5280 §4.2.1.10

Monitoring Recommendations

Enable verbose PKIX validation logging in Java applications to capture NameConstraints decisions during certificate chain building
Alert on newly issued certificates from name-constrained CAs whose SAN entries fall outside the declared permitted subtree
Track software bill of materials (SBOM) drift for org.bouncycastle components across build pipelines and runtime hosts

How to Mitigate CVE-2026-8763

Immediate Actions Required

Upgrade Bouncy Castle for Java to 1.85 or later for the mainline distribution
Upgrade Bouncy Castle for Java LTS to 2.73.12 or later
Upgrade BC-FJA FIPS builds to 1.0.2.7, 2.0.2, or 2.1.3 depending on the deployed series
Rebuild and redeploy all applications that shade or repackage Bouncy Castle to prevent stale copies from remaining in production

Patch Information

The fix is committed in the Bouncy Castle Java repository. See the patch commit and the CVE-2026-8763 wiki entry for full details. The patch enforces RFC 5280 initial-prefix matching for directoryName and normalizes trailing dots in rfc822Name and URI comparisons. Relaxed matching for GSMA SGP.22 remains gated behind the Properties.X509_SGP22_NAME_CONSTRAINTS flag.

Workarounds

Restrict trust anchors so that name-constrained intermediate CAs are the only issuers accepted for the impacted namespaces, reducing exposure until patching completes
Perform application-level SAN normalization by stripping trailing dots from rfc822Name and URI host components before invoking certificate validation
Revoke and reissue certificates from any name-constrained CA whose issuance workflow cannot be audited for abuse

bash

# Verify the deployed Bouncy Castle provider version in a running Java application
java -cp bcprov-jdk18on.jar org.bouncycastle.util.Dump | head -n 1

# Or inspect the JAR manifest directly
unzip -p bcprov-jdk18on.jar META-INF/MANIFEST.MF | grep -i 'Bundle-Version'