CVE-2026-63576

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63576

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63576.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63576

Published

2026-10-02T07:07:02Z

Modified

2026-10-04T02:46:43Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

URI name constraints checked against a mis-parsed host

Details

Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.

Database specific

{
    "cna_assigner":  "bcorg",
    "cwe_ids":  [
        "CWE-295"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63576.json"
}

References

Affected packages

Git / github.com/bcgit/bc-csharp

Affected ranges

Type

GIT

Repo

https://github.com/bcgit/bc-csharp

Events

Introduced

Fixed

4007498b13582d90ee1eda5d9920c324428b98b3

Fixed

f196a22bbf7765cc19b0c4f4645c74ea7ad35e09

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.7.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

release-1.*

release-1.8.0

release-1.8.0-RC.1

release-1.8.0-RC.2

release-1.8.0-RC.3

release-1.8.0-beta.1

release-1.8.0-beta.2

release-1.8.0-beta.3

release-1.8.0-beta.4

release-1.8.1

release-1.8.10

release-1.8.2

release-1.8.3

release-1.8.4

release-1.8.5

release-1.8.6

release-1.8.7

release-1.8.8

release-1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63576.json"