kritisch
CVE-2026-8763
org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (hoch), Amazon (hoch).
Beschreibung
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on und 1 weitere | 1.0.2.7, 2.0.2, 2.1.3 und 2 weitere |
| amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail und 4 weitere | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform, apache-nifi-2.12, apache-nifi-registry-2.11 und 61 weitere | 2.0.0-r8 und 51 weitere |
| debian 11 | bouncycastle | kein Fix angegeben |
| debian 12 | bouncycastle | kein Fix angegeben |
| debian 13 | bouncycastle | kein Fix angegeben |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | kein Fix angegeben |
| echo maven::Echo OSV | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop, apache-iceberg-sink-connector, apache-iceberg-sink-connector-fips und 27 weitere | 2.19.0-r0 und 21 weitere |
| rapidfort amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail und 4 weitere | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
Alle 178 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips | 1.0.2.7, 2.0.2, 2.1.3 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk15to18 | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk18on | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-lts8on | 2.73.12 |
| amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform | 2.0.0-r8 |
| chainguard | apache-nifi-2.12 | 2.12.0-r1 |
| chainguard | apache-nifi-registry-2.11 | 2.11.0-r4 |
| chainguard | apache-nifi-registry-2.12 | 2.12.0-r1 |
| chainguard | apache-pulsar-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-4.2 | 4.2.4-r5 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-fips-4.2 | 4.2.4-r5 |
| chainguard | bouncycastle-fips | 2.1.3-r0 |
| chainguard | camunda-8.8 | 8.8.39-r1 |
| chainguard | camunda-zeebe-8.6 | 8.6.39-r13 |
| chainguard | camunda-zeebe-8.7 | 8.7.41-r1 |
| chainguard | camunda-zeebe-8.8 | 8.8.39-r1 |
| chainguard | cassandra-fips-4.0 | 4.0.21-r2 |
| chainguard | cassandra-fips-4.1 | 4.1.12-r2 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r15 |
| chainguard | conductor | 3.32.4-r1 |
| chainguard | druid | 37.0.0-r57 |
| chainguard | elasticsearch-9.2 | 9.2.8-r24 |
| chainguard | geoserver-2.27 | 2.27.6-r2 |
| chainguard | geoserver-2.28 | 2.28.5-r2 |
| chainguard | geoserver-3.0 | 3.0.1-r4 |
| chainguard | ghidra | 12.1.4-r1 |
| chainguard | guacamole-client | 1.6.0-r17 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r16 |
| chainguard | hono | 2.7.0-r41 |
| chainguard | jenkins-2.568 | 2.568.3-r1 |
| chainguard | kayenta-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-2025.4 | 2025.4.6-r16 |
| chainguard | kayenta-2026.0 | 2026.0.7-r5 |
| chainguard | kayenta-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-2026.2 | 2026.2.5-r3 |
| chainguard | kayenta-fips-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-fips-2025.4 | 2025.4.6-r9 |
| chainguard | kayenta-fips-2026.0 | 2026.0.5-r5 |
| chainguard | kayenta-fips-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-fips-2026.2 | 2026.2.5-r3 |
| chainguard | keycloak-26.6 | 26.6.7-r1 |
| chainguard | keycloak-26.7 | 26.7.4-r1 |
| chainguard | keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | kserve-modelmesh | 0.12.0-r40 |
| chainguard | logstash-8.19 | 8.19.21-r6 |
| chainguard | logstash-9.4 | 9.4.8-r0 |
| chainguard | logstash-9.5 | 9.5.5-r0 |
| chainguard | logstash-fips-9.4 | 9.4.7-r6 |
| chainguard | logstash-fips-9.5 | 9.5.4-r9 |
| chainguard | nacos | 3.2.4-r2 |
| chainguard | nacos-docker | 3.2.4-r2 |
| chainguard | nuxeo-2023 | 2023.45-r16 |
| chainguard | nuxeo-2025 | 2025.20-r1 |
| chainguard | opensearch-2 | 2.19.6-r12 |
| chainguard | ranger | 2.9.0-r6 |
| chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r28 |
| chainguard | request-9047-keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | request-9047-keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| chainguard | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| chainguard | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| chainguard | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| chainguard | spark-4.0 | 4.0.4-r5 |
| chainguard | wazuh-indexer | 4.14.7-r6 |
| chainguard | wso2is | 7.3.0-r4 |
| chainguard | zipkin | 3.6.1-r28 |
| debian 11 | bouncycastle | kein Fix angegeben |
| debian 12 | bouncycastle | kein Fix angegeben |
| debian 13 | bouncycastle | kein Fix angegeben |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | kein Fix angegeben |
| echo maven::Echo OSV | org.bouncycastle:bc-fips | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk15to18 | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-iceberg-sink-connector | 1.12.0-r0 |
| minimos | apache-iceberg-sink-connector-fips | 1.11.0-r1 |
| minimos | apache-nifi | 2.11.0-r0 |
| minimos | apache-nifi-registry | 2.11.0-r0 |
| minimos | apache-polaris | 1.8.0-r0 |
| minimos | apache-polaris-fips | 1.8.0-r0 |
| minimos | apache-pulsar-4.0 | 4.0.14-r0 |
| minimos | apache-pulsar-fips-4.0 | 4.0.14-r0 |
| minimos | camunda-8.8 | 8.8.35-r0 |
| minimos | camunda-8.9 | 8.9.15-r0 |
| minimos | elasticsearch-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-9.5 | 9.5.1-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-fips-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-fips-9.5 | 9.5.1-r0 |
| minimos | gradle-8 | 8.14.6-r0 |
| minimos | gradle-9 | 9.7.1-r0 |
| minimos | jenkins | 2.577-r0 |
| minimos | jruby-10.0 | 10.0.7.0-r0 |
| minimos | jruby-10.1 | 10.1.1.0-r0 |
| minimos | keycloak | 26.7.5-r0 |
| minimos | keycloak-fips | 26.7.5-r0 |
| minimos | logstash-9.4 | 9.4.8-r0 |
| minimos | logstash-9.5 | 9.5.5-r0 |
| minimos | nexus3 | 3.95.0.07-r0 |
| minimos | nexus3-fips | 3.95.0.07-r0 |
| minimos | opensearch-3 | 3.8.0-r0 |
| minimos | sonarqube | 26.10.0.133078-r0 |
| rapidfort amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
| rapidfort debian 13 | bouncycastle | 0:1.86-1 |
| Red Hat | bcpkix-jdk15on | kein Fix angegeben |
| Red Hat | bcpkix-jdk18on | kein Fix angegeben |
| Red Hat | bcprov-jdk15on | kein Fix angegeben |
| Red Hat | candlepin | kein Fix angegeben |
| Red Hat | candlepin-selinux | kein Fix angegeben |
| Red Hat | ceph | kein Fix angegeben |
| Red Hat | ceph-base | kein Fix angegeben |
| Red Hat | ceph-common | kein Fix angegeben |
| Red Hat | ceph-fuse | kein Fix angegeben |
| Red Hat | ceph-immutable-object-cache | kein Fix angegeben |
| Red Hat | ceph-mib | kein Fix angegeben |
| Red Hat | ceph-resource-agents | kein Fix angegeben |
| Red Hat | ceph-selinux | kein Fix angegeben |
| Red Hat | cephadm | kein Fix angegeben |
| Red Hat | cephfs-top | kein Fix angegeben |
| Red Hat | libarrow | kein Fix angegeben |
| Red Hat | libarrow-doc | kein Fix angegeben |
| Red Hat | libcephfs-devel | kein Fix angegeben |
| Red Hat | libcephfs-proxy2 | kein Fix angegeben |
| Red Hat | libcephfs2 | kein Fix angegeben |
| Red Hat | librados-devel | kein Fix angegeben |
| Red Hat | librados2 | kein Fix angegeben |
| Red Hat | libradospp-devel | kein Fix angegeben |
| Red Hat | libradosstriper1 | kein Fix angegeben |
| Red Hat | librbd-devel | kein Fix angegeben |
| Red Hat | librbd1 | kein Fix angegeben |
| Red Hat | librgw-devel | kein Fix angegeben |
| Red Hat | librgw2 | kein Fix angegeben |
| Red Hat | parquet-libs | kein Fix angegeben |
| Red Hat | python3-ceph-argparse | kein Fix angegeben |
| Red Hat | python3-ceph-common | kein Fix angegeben |
| Red Hat | python3-cephfs | kein Fix angegeben |
| Red Hat | python3-rados | kein Fix angegeben |
| Red Hat | python3-rbd | kein Fix angegeben |
| Red Hat | python3-rgw | kein Fix angegeben |
| Red Hat | rbd-nbd | kein Fix angegeben |
| seal maven::Seal Security Database | org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk18on | 1.82+sp3p3 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| seal maven::Seal Security Database | seal.sp1p1.org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| wolfi | apache-pulsar-4.2 | 4.2.4-r5 |
| wolfi | druid | 37.0.0-r57 |
| wolfi | keycloak-26.6 | 26.6.7-r1 |
| wolfi | kserve-modelmesh | 0.12.0-r40 |
| wolfi | logstash-9.4 | 9.4.8-r0 |
| wolfi | opensearch-2 | 2.19.6-r11 |
| wolfi | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| wolfi | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| wolfi | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| wolfi | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| wolfi | spark-4.0 | 4.0.4-r5 |
| wolfi | zipkin | 3.6.1-r28 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-8763
- https://advisory.echohq.com/cve/CVE-2026-8763
- https://github.com/advisories/GHSA-9pwp-9qqc-pr26
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
- https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
- https://github.com/bcgit/bc-java/wiki/CVE-2026-8763