crítica
CVE-2026-8763
org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Amazon (alta).
Descripción
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on y 1 más | 1.0.2.7, 2.0.2, 2.1.3 y 2 más |
| amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail y 4 más | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform, apache-nifi-2.12, apache-nifi-registry-2.11 y 61 más | 2.0.0-r8 y 51 más |
| debian 11 | bouncycastle | sin corrección indicada |
| debian 12 | bouncycastle | sin corrección indicada |
| debian 13 | bouncycastle | sin corrección indicada |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | sin corrección indicada |
| echo maven::Echo OSV | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop, apache-iceberg-sink-connector, apache-iceberg-sink-connector-fips y 27 más | 2.19.0-r0 y 21 más |
| rapidfort amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail y 4 más | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
Mostrar las 178 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips | 1.0.2.7, 2.0.2, 2.1.3 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk15to18 | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk18on | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-lts8on | 2.73.12 |
| amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform | 2.0.0-r8 |
| chainguard | apache-nifi-2.12 | 2.12.0-r1 |
| chainguard | apache-nifi-registry-2.11 | 2.11.0-r4 |
| chainguard | apache-nifi-registry-2.12 | 2.12.0-r1 |
| chainguard | apache-pulsar-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-4.2 | 4.2.4-r5 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-fips-4.2 | 4.2.4-r5 |
| chainguard | bouncycastle-fips | 2.1.3-r0 |
| chainguard | camunda-8.8 | 8.8.39-r1 |
| chainguard | camunda-zeebe-8.6 | 8.6.39-r13 |
| chainguard | camunda-zeebe-8.7 | 8.7.41-r1 |
| chainguard | camunda-zeebe-8.8 | 8.8.39-r1 |
| chainguard | cassandra-fips-4.0 | 4.0.21-r2 |
| chainguard | cassandra-fips-4.1 | 4.1.12-r2 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r15 |
| chainguard | conductor | 3.32.4-r1 |
| chainguard | druid | 37.0.0-r57 |
| chainguard | elasticsearch-9.2 | 9.2.8-r24 |
| chainguard | geoserver-2.27 | 2.27.6-r2 |
| chainguard | geoserver-2.28 | 2.28.5-r2 |
| chainguard | geoserver-3.0 | 3.0.1-r4 |
| chainguard | ghidra | 12.1.4-r1 |
| chainguard | guacamole-client | 1.6.0-r17 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r16 |
| chainguard | hono | 2.7.0-r41 |
| chainguard | jenkins-2.568 | 2.568.3-r1 |
| chainguard | kayenta-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-2025.4 | 2025.4.6-r16 |
| chainguard | kayenta-2026.0 | 2026.0.7-r5 |
| chainguard | kayenta-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-2026.2 | 2026.2.5-r3 |
| chainguard | kayenta-fips-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-fips-2025.4 | 2025.4.6-r9 |
| chainguard | kayenta-fips-2026.0 | 2026.0.5-r5 |
| chainguard | kayenta-fips-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-fips-2026.2 | 2026.2.5-r3 |
| chainguard | keycloak-26.6 | 26.6.7-r1 |
| chainguard | keycloak-26.7 | 26.7.4-r1 |
| chainguard | keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | kserve-modelmesh | 0.12.0-r40 |
| chainguard | logstash-8.19 | 8.19.21-r6 |
| chainguard | logstash-9.4 | 9.4.8-r0 |
| chainguard | logstash-9.5 | 9.5.5-r0 |
| chainguard | logstash-fips-9.4 | 9.4.7-r6 |
| chainguard | logstash-fips-9.5 | 9.5.4-r9 |
| chainguard | nacos | 3.2.4-r2 |
| chainguard | nacos-docker | 3.2.4-r2 |
| chainguard | nuxeo-2023 | 2023.45-r16 |
| chainguard | nuxeo-2025 | 2025.20-r1 |
| chainguard | opensearch-2 | 2.19.6-r12 |
| chainguard | ranger | 2.9.0-r6 |
| chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r28 |
| chainguard | request-9047-keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | request-9047-keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| chainguard | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| chainguard | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| chainguard | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| chainguard | spark-4.0 | 4.0.4-r5 |
| chainguard | wazuh-indexer | 4.14.7-r6 |
| chainguard | wso2is | 7.3.0-r4 |
| chainguard | zipkin | 3.6.1-r28 |
| debian 11 | bouncycastle | sin corrección indicada |
| debian 12 | bouncycastle | sin corrección indicada |
| debian 13 | bouncycastle | sin corrección indicada |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | sin corrección indicada |
| echo maven::Echo OSV | org.bouncycastle:bc-fips | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk15to18 | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-iceberg-sink-connector | 1.12.0-r0 |
| minimos | apache-iceberg-sink-connector-fips | 1.11.0-r1 |
| minimos | apache-nifi | 2.11.0-r0 |
| minimos | apache-nifi-registry | 2.11.0-r0 |
| minimos | apache-polaris | 1.8.0-r0 |
| minimos | apache-polaris-fips | 1.8.0-r0 |
| minimos | apache-pulsar-4.0 | 4.0.14-r0 |
| minimos | apache-pulsar-fips-4.0 | 4.0.14-r0 |
| minimos | camunda-8.8 | 8.8.35-r0 |
| minimos | camunda-8.9 | 8.9.15-r0 |
| minimos | elasticsearch-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-9.5 | 9.5.1-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-fips-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-fips-9.5 | 9.5.1-r0 |
| minimos | gradle-8 | 8.14.6-r0 |
| minimos | gradle-9 | 9.7.1-r0 |
| minimos | jenkins | 2.577-r0 |
| minimos | jruby-10.0 | 10.0.7.0-r0 |
| minimos | jruby-10.1 | 10.1.1.0-r0 |
| minimos | keycloak | 26.7.5-r0 |
| minimos | keycloak-fips | 26.7.5-r0 |
| minimos | logstash-9.4 | 9.4.8-r0 |
| minimos | logstash-9.5 | 9.5.5-r0 |
| minimos | nexus3 | 3.95.0.07-r0 |
| minimos | nexus3-fips | 3.95.0.07-r0 |
| minimos | opensearch-3 | 3.8.0-r0 |
| minimos | sonarqube | 26.10.0.133078-r0 |
| rapidfort amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
| rapidfort debian 13 | bouncycastle | 0:1.86-1 |
| Red Hat | bcpkix-jdk15on | sin corrección indicada |
| Red Hat | bcpkix-jdk18on | sin corrección indicada |
| Red Hat | bcprov-jdk15on | sin corrección indicada |
| Red Hat | candlepin | sin corrección indicada |
| Red Hat | candlepin-selinux | sin corrección indicada |
| Red Hat | ceph | sin corrección indicada |
| Red Hat | ceph-base | sin corrección indicada |
| Red Hat | ceph-common | sin corrección indicada |
| Red Hat | ceph-fuse | sin corrección indicada |
| Red Hat | ceph-immutable-object-cache | sin corrección indicada |
| Red Hat | ceph-mib | sin corrección indicada |
| Red Hat | ceph-resource-agents | sin corrección indicada |
| Red Hat | ceph-selinux | sin corrección indicada |
| Red Hat | cephadm | sin corrección indicada |
| Red Hat | cephfs-top | sin corrección indicada |
| Red Hat | libarrow | sin corrección indicada |
| Red Hat | libarrow-doc | sin corrección indicada |
| Red Hat | libcephfs-devel | sin corrección indicada |
| Red Hat | libcephfs-proxy2 | sin corrección indicada |
| Red Hat | libcephfs2 | sin corrección indicada |
| Red Hat | librados-devel | sin corrección indicada |
| Red Hat | librados2 | sin corrección indicada |
| Red Hat | libradospp-devel | sin corrección indicada |
| Red Hat | libradosstriper1 | sin corrección indicada |
| Red Hat | librbd-devel | sin corrección indicada |
| Red Hat | librbd1 | sin corrección indicada |
| Red Hat | librgw-devel | sin corrección indicada |
| Red Hat | librgw2 | sin corrección indicada |
| Red Hat | parquet-libs | sin corrección indicada |
| Red Hat | python3-ceph-argparse | sin corrección indicada |
| Red Hat | python3-ceph-common | sin corrección indicada |
| Red Hat | python3-cephfs | sin corrección indicada |
| Red Hat | python3-rados | sin corrección indicada |
| Red Hat | python3-rbd | sin corrección indicada |
| Red Hat | python3-rgw | sin corrección indicada |
| Red Hat | rbd-nbd | sin corrección indicada |
| seal maven::Seal Security Database | org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk18on | 1.82+sp3p3 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| seal maven::Seal Security Database | seal.sp1p1.org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| wolfi | apache-pulsar-4.2 | 4.2.4-r5 |
| wolfi | druid | 37.0.0-r57 |
| wolfi | keycloak-26.6 | 26.6.7-r1 |
| wolfi | kserve-modelmesh | 0.12.0-r40 |
| wolfi | logstash-9.4 | 9.4.8-r0 |
| wolfi | opensearch-2 | 2.19.6-r11 |
| wolfi | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| wolfi | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| wolfi | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| wolfi | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| wolfi | spark-4.0 | 4.0.4-r5 |
| wolfi | zipkin | 3.6.1-r28 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-8763
- https://advisory.echohq.com/cve/CVE-2026-8763
- https://github.com/advisories/GHSA-9pwp-9qqc-pr26
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
- https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
- https://github.com/bcgit/bc-java/wiki/CVE-2026-8763