CVE-2026-8763: Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

August 3, 2026 (updated September 18, 2026)

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

References

github.com/advisories/GHSA-9pwp-9qqc-pr26
github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
github.com/bcgit/bc-java/releases/tag/r1rv85v2
github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
github.com/bcgit/bc-java/wiki/CVE-2026-8763
nvd.nist.gov/vuln/detail/CVE-2026-8763

Code Behaviors & Features

Detect and mitigate CVE-2026-8763 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →