# CVE-2026-8763: Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

> CVE-2026-8763 (GitHub advisory GHSA-9pwp-9qqc-pr26) is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3, classed as Improper Certificate Validation (CWE-295), in 4 packages, including org.bouncycastle:bc-fips (Maven) and org.bouncycastle:bcprov-jdk18on (Maven). Fixed versions: org.bouncycastle:bc-fips 1.0.2.7, 2.0.2 or 2.1.3; org.bouncycastle:bcprov-jdk18on 1.85; and 2 more packages.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-8763

| Field | Value |
| --- | --- |
| CVE | CVE-2026-8763 |
| GHSA | GHSA-9pwp-9qqc-pr26 |
| Severity | Critical |
| CVSS 4.0 | 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber` (GitHub Advisory Database) |
| CVSS 3.1 | 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-295 Improper Certificate Validation |
| EPSS | 0.45% (higher than 36% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact total |
| Published | 3 Aug 2026 |
| Modified | 18 Sept 2026 |

## Description

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.bouncycastle:bc-fips | Maven | `pkg:maven/org.bouncycastle/bc-fips` | < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 | 1.0.2.7, 2.0.2, 2.1.3 |
| org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | < 1.85 | 1.85 |
| org.bouncycastle:bcprov-lts8on | Maven | `pkg:maven/org.bouncycastle/bcprov-lts8on` | < 2.73.12 | 2.73.12 |
| org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | < 1.85 | 1.85 |

## Fix commits

- Patch: https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
- Release: https://github.com/bcgit/bc-java/commit/57fbd3c501f7a369f64eda311d6a709fc0bcae84 (1.85)

## Questions

**What is the GHSA ID for CVE-2026-8763?**

GitHub tracks CVE-2026-8763 as GHSA-9pwp-9qqc-pr26.

**What is the CVSS score of CVE-2026-8763?**

CVE-2026-8763 has a CVSS 4.0 base score of 9.3 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber. Other published scores: CVSS 3.1 9.1.

**Which versions are affected by CVE-2026-8763?**

org.bouncycastle:bc-fips (Maven): < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3. org.bouncycastle:bcprov-jdk18on (Maven): < 1.85. org.bouncycastle:bcprov-lts8on (Maven): < 2.73.12. org.bouncycastle:bcprov-jdk15to18 (Maven): < 1.85.

**How do I fix CVE-2026-8763?**

Upgrade each package to its fixed version: org.bouncycastle:bc-fips 1.0.2.7, 2.0.2 or 2.1.3; org.bouncycastle:bcprov-jdk18on 1.85; org.bouncycastle:bcprov-lts8on 2.73.12; org.bouncycastle:bcprov-jdk15to18 1.85. The fix is in commit 2c28b25.

**What is the Package URL (PURL) for CVE-2026-8763?**

The affected packages' PURLs are pkg:maven/org.bouncycastle/bc-fips, pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bcprov-lts8on and pkg:maven/org.bouncycastle/bcprov-jdk15to18.

**Is CVE-2026-8763 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-8763. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 36% of CVEs.

## References

- https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558 (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2026-8763 (advisory)
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8763.json (advisory)
- https://github.com/advisories/GHSA-9pwp-9qqc-pr26 (advisory)
- https://github.com/bcgit/bc-java (package)
- https://github.com/bcgit/bc-lts-java (package)
- https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
- https://github.com/bcgit/bc-java/wiki/CVE-2026-8763
- https://www.bouncycastle.org/download/bouncy-castle-java-fips/
- https://www.bouncycastle.org/download/bouncy-castle-java-lts/
- https://www.bouncycastle.org/download/bouncy-castle-java/

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-8763), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.