CVE-2026-71889

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71889
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71889.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71889
Downstream
Published
2026-10-03T08:31:01Z
Modified
2026-10-06T07:05:11Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
Summary
PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
Details

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its own issuing CA therefore reported isValidCertPath() true with an empty error list, while CertPathValidator.getInstance("PKIX", "BC"), which shares no code with the reviewer, rejected the identical chain against the identical trust anchor. An application using the reviewer to make the trust decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA was never authorised to issue. Both copies now check every certificate in the path including the target, waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Database specific 
{
    "cna_assigner":  "bcorg",
    "cwe_ids":  [
        "CWE-295"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71889.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.0.4"
                },
                {
                    "fixed":  "1.0.13"
                },
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.0.13"
                },
                {
                    "introduced":  "2.1.0"
                },
                {
                    "fixed":  "2.1.13"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/bcgit/bc-java

Affected ranges

Type
GIT
Repo
https://github.com/bcgit/bc-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eacda831fbe15b272933e40841d8b0827b556fae
Fixed
06dcff2f51037095de126986285c998e3455ab85
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.86"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/bcgit/bc-lts-java
Events
Introduced
468b5082f3f0971e80bf9edb7029c17b39b9ba0c
Fixed
43d27611d3b82e54050d1def60b516f8295e485b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.73.0"
        },
        {
            "fixed":  "2.73.13"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
r1rv73
r2rv73dot0
r2rv73dot1
r2rv73dot10
r2rv73dot11
r2rv73dot12
r2rv73dot12dot1
r2rv73dot3
r2rv73dot4
r2rv73dot6
r2rv73dot8
r2rv73dot9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71889.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "138181247408899040249400018688599970935",
                "157076650123742976017600283311648688772",
                "299831574497901735587913555181378186651",
                "119656624553792833336683544475511307167",
                "285360667363707167858519504783424612322"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-0d8eac13",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target":  {
            "file":  "tls/src/main/java/org/bouncycastle/jsse/provider/BouncyCastleJsseProvider.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "198998642969818417039950766575124474122",
                "176485554327561807626586916754186965744",
                "30122234930542453359703034466236659062",
                "145259701364354400312802743171023262636"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-2bd8f355",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target":  {
            "file":  "core/src/main/java/org/bouncycastle/crypto/CryptoServicesRegistrar.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "107492299239844656455992969154194751546",
                "88031704519188679500783664866555175428",
                "8719723814761448299496542886894605159",
                "203626202713639004218273365189024195254"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-3e15219a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target":  {
            "file":  "prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "295500584398542764947287373862000430888",
                "172221608444169507199341352125602484627",
                "57505545000901232778060527829945245882",
                "263899473782736862971673781595332072078",
                "216028627198895390275901418047797552759",
                "210607649060855442118362362665314243665",
                "337887579349923897407469260153864993088",
                "295720007834748964131690719994968384016",
                "12521590229406552336840634994001410488",
                "88876089744439672492135031711132712897",
                "278367297241436615380811475197544840799",
                "91372423597219642835852098097248012904",
                "301650008232168788628693289770897165803",
                "8281811506053818820549556513092183251",
                "194021995884000274630626409582550661701"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-480092ef",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
        "target":  {
            "file":  "pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "295500584398542764947287373862000430888",
                "172221608444169507199341352125602484627",
                "57505545000901232778060527829945245882",
                "263899473782736862971673781595332072078",
                "216028627198895390275901418047797552759",
                "210607649060855442118362362665314243665",
                "337887579349923897407469260153864993088",
                "295720007834748964131690719994968384016",
                "12521590229406552336840634994001410488",
                "88876089744439672492135031711132712897",
                "278367297241436615380811475197544840799",
                "91372423597219642835852098097248012904",
                "301650008232168788628693289770897165803",
                "8281811506053818820549556513092183251",
                "194021995884000274630626409582550661701"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-499f626b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
        "target":  {
            "file":  "prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "125299400173226425464756601737894990468",
            "length":  2796
        },
        "id":  "CVE-2026-71889-673fef4e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
        "target":  {
            "file":  "pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java",
            "function":  "checkNameConstraints"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "15037932978976058678046096832551679440",
            "length":  167
        },
        "id":  "CVE-2026-71889-69554e16",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-lts-java/commit/43d27611d3b82e54050d1def60b516f8295e485b",
        "target":  {
            "file":  "prov/src/main/java/org/bouncycastle/jce/provider/BouncyCastleProvider.java",
            "function":  "BouncyCastleProvider"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "27917510316358637058031569631948427937",
            "length":  2932
        },
        "id":  "CVE-2026-71889-a7e330be",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
        "target":  {
            "file":  "prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java",
            "function":  "checkNameConstraints"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "230242234970025079931154771994337785778",
                "285811415634116389271817069658447299950",
                "176241812010680841866587892205326642888",
                "164189333145014800991160585666624087085",
                "77923431767122097219063861094641571561",
                "96297538165178063518285905285967905091",
                "143312396464101909197610641354626681799",
                "213572580572699188633439898739359706759",
                "210869767712034940529073348941029344211",
                "325443210215878457875312366983959395890",
                "258120413589006172756060669556340658746",
                "94876040377431885712559190627611146850",
                "68514807660656851300740681009268569908"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-71889-e38c28ba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
        "target":  {
            "file":  "pkix/src/test/java/org/bouncycastle/pkix/test/CheckNameConstraintsTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-06T07:05:11Z"