CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). PKIXNameConstraintValidator strips a trailing dot before comparing dNSName values but not rfc822Name or URI values, which are compared with a plain case-insensitive match. A certificate whose email or URI SAN ends in a dot therefore evades an excludedSubtrees entry for the same host and path validation succeeds. An attacker controlling a name-constrained intermediate CA can issue certificates for names the constraints were meant to exclude.