Critical severity9.1OSV Advisory· Published Aug 3, 2026· Updated Sep 2, 2026

CVE-2026-8763

Description

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.bouncycastle:bc-fipsMaven	< 1.0.2.7	1.0.2.7
org.bouncycastle:bc-fipsMaven	>= 2.0.0, < 2.0.2	2.0.2
org.bouncycastle:bc-fipsMaven	>= 2.1.0, < 2.1.3	2.1.3
org.bouncycastle:bcprov-jdk18onMaven	< 1.85	1.85
org.bouncycastle:bcprov-lts8onMaven	< 2.73.12	2.73.12
org.bouncycastle:bcprov-jdk15to18Maven	< 1.85	1.85

Affected products

Legion Of The Bouncy Castle Inc./Bc Lts JavaOSV
Range: r2rv73dot11, r2rv73dot10, r2rv73dot9, …
Legion Of The Bouncy Castle Inc./Bc Java2 versions
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*range: <1.85
- (no CPE)range: <1.85, <2.73.12, <1.0.2.7, <2.0.2, <2.1.3
Legion Of The Bouncy Castle Inc./Bouncy Castle For Java Lts2 versions
cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bouncycastle:bouncy_castle_for_java_lts:*:*:*:*:*:*:*:*range: <=2.73.11
- (no CPE)range: <2.73.12
Legion Of The Bouncy Castle Inc./Fips Java API
cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*
Range: >=1.0.0,<1.0.2.7
Legion Of The Bouncy Castle Inc./Bouncy Castle for Javallm-create
Range: <1.85
osv-coords3 versions
pkg:apk/chainguard/bouncycastle-fips pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/bouncycastle&distro=openSUSE%20Tumbleweed
< 2.1.3-r0+ 2 more
- (no CPE)range: < 2.1.3-r0
- (no CPE)range: < 1.85-160000.1.1
- (no CPE)range: < 1.85-1.1

Patches

Vulnerability mechanics

References

github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558nvdPatchWEB
github.com/advisories/GHSA-9pwp-9qqc-pr26ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-8763ghsaADVISORY
github.com/bcgit/bc-java/releases/tag/r1rv85v2ghsaWEB

News mentions

Bouncy Castle for Java: 25 Vulnerabilities Disclosed Together on August 3, 2026
Vypr Intelligence · Aug 3, 2026
Bouncy Castle for Java: 25 Vulnerabilities Disclosed in Single Batch on August 3, 2026
Vypr Intelligence · Aug 3, 2026

Severity

CriticalCVSS v3.1

9.1/ 10

CVSS v49.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected

Source repos: github.com/bcgit/bc-java
github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
github.com/bcgit/bc-java/wiki/CVE-2026-8763

EPSS

Probability of exploitation in the next 30 days.

0.43%

VYPR risk score

Composite of severity, exploitation, and reach.

0.52high

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-295
Improper Certificate Validation

CVE ID

CVE-2026-8763