critical
CVE-2026-8763
org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (high), Amazon (high).
Description
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on and 1 more | 1.0.2.7, 2.0.2, 2.1.3 and 2 more |
| amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail and 4 more | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform, apache-nifi-2.12, apache-nifi-registry-2.11 and 61 more | 2.0.0-r8 and 51 more |
| debian 11 | bouncycastle | no fix listed |
| debian 12 | bouncycastle | no fix listed |
| debian 13 | bouncycastle | no fix listed |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | no fix listed |
| echo maven::Echo OSV | org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop, apache-iceberg-sink-connector, apache-iceberg-sink-connector-fips and 27 more | 2.19.0-r0 and 21 more |
| rapidfort amazon linux 2023 | bouncycastle, bouncycastle-javadoc, bouncycastle-mail and 4 more | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
Show all 178 entries from 16 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.bouncycastle:bc-fips | 1.0.2.7, 2.0.2, 2.1.3 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk15to18 | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-jdk18on | 1.85 |
| maven::GitHub Security Advisory Maven | org.bouncycastle:bcprov-lts8on | 2.73.12 |
| amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| chainguard | airbyte-platform | 2.0.0-r8 |
| chainguard | apache-nifi-2.12 | 2.12.0-r1 |
| chainguard | apache-nifi-registry-2.11 | 2.11.0-r4 |
| chainguard | apache-nifi-registry-2.12 | 2.12.0-r1 |
| chainguard | apache-pulsar-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-4.2 | 4.2.4-r5 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.13-r4 |
| chainguard | apache-pulsar-fips-4.2 | 4.2.4-r5 |
| chainguard | bouncycastle-fips | 2.1.3-r0 |
| chainguard | camunda-8.8 | 8.8.39-r1 |
| chainguard | camunda-zeebe-8.6 | 8.6.39-r13 |
| chainguard | camunda-zeebe-8.7 | 8.7.41-r1 |
| chainguard | camunda-zeebe-8.8 | 8.8.39-r1 |
| chainguard | cassandra-fips-4.0 | 4.0.21-r2 |
| chainguard | cassandra-fips-4.1 | 4.1.12-r2 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r15 |
| chainguard | conductor | 3.32.4-r1 |
| chainguard | druid | 37.0.0-r57 |
| chainguard | elasticsearch-9.2 | 9.2.8-r24 |
| chainguard | geoserver-2.27 | 2.27.6-r2 |
| chainguard | geoserver-2.28 | 2.28.5-r2 |
| chainguard | geoserver-3.0 | 3.0.1-r4 |
| chainguard | ghidra | 12.1.4-r1 |
| chainguard | guacamole-client | 1.6.0-r17 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r16 |
| chainguard | hono | 2.7.0-r41 |
| chainguard | jenkins-2.568 | 2.568.3-r1 |
| chainguard | kayenta-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-2025.4 | 2025.4.6-r16 |
| chainguard | kayenta-2026.0 | 2026.0.7-r5 |
| chainguard | kayenta-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-2026.2 | 2026.2.5-r3 |
| chainguard | kayenta-fips-2025.2 | 2025.2.4-r11 |
| chainguard | kayenta-fips-2025.4 | 2025.4.6-r9 |
| chainguard | kayenta-fips-2026.0 | 2026.0.5-r5 |
| chainguard | kayenta-fips-2026.1 | 2026.1.2-r7 |
| chainguard | kayenta-fips-2026.2 | 2026.2.5-r3 |
| chainguard | keycloak-26.6 | 26.6.7-r1 |
| chainguard | keycloak-26.7 | 26.7.4-r1 |
| chainguard | keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | kserve-modelmesh | 0.12.0-r40 |
| chainguard | logstash-8.19 | 8.19.21-r6 |
| chainguard | logstash-9.4 | 9.4.8-r0 |
| chainguard | logstash-9.5 | 9.5.5-r0 |
| chainguard | logstash-fips-9.4 | 9.4.7-r6 |
| chainguard | logstash-fips-9.5 | 9.5.4-r9 |
| chainguard | nacos | 3.2.4-r2 |
| chainguard | nacos-docker | 3.2.4-r2 |
| chainguard | nuxeo-2023 | 2023.45-r16 |
| chainguard | nuxeo-2025 | 2025.20-r1 |
| chainguard | opensearch-2 | 2.19.6-r12 |
| chainguard | ranger | 2.9.0-r6 |
| chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r28 |
| chainguard | request-9047-keycloak-fips-26.6 | 26.6.7-r1 |
| chainguard | request-9047-keycloak-fips-26.7 | 26.7.4-r1 |
| chainguard | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| chainguard | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| chainguard | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| chainguard | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| chainguard | spark-4.0 | 4.0.4-r5 |
| chainguard | wazuh-indexer | 4.14.7-r6 |
| chainguard | wso2is | 7.3.0-r4 |
| chainguard | zipkin | 3.6.1-r28 |
| debian 11 | bouncycastle | no fix listed |
| debian 12 | bouncycastle | no fix listed |
| debian 13 | bouncycastle | no fix listed |
| debian 14 | bouncycastle | 1.86-1 |
| echo | bouncycastle | no fix listed |
| echo maven::Echo OSV | org.bouncycastle:bc-fips | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk15to18 | 1.0.2.7 |
| echo maven::Echo OSV | org.bouncycastle:bcprov-jdk18on | 1.0.2.7 |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-iceberg-sink-connector | 1.12.0-r0 |
| minimos | apache-iceberg-sink-connector-fips | 1.11.0-r1 |
| minimos | apache-nifi | 2.11.0-r0 |
| minimos | apache-nifi-registry | 2.11.0-r0 |
| minimos | apache-polaris | 1.8.0-r0 |
| minimos | apache-polaris-fips | 1.8.0-r0 |
| minimos | apache-pulsar-4.0 | 4.0.14-r0 |
| minimos | apache-pulsar-fips-4.0 | 4.0.14-r0 |
| minimos | camunda-8.8 | 8.8.35-r0 |
| minimos | camunda-8.9 | 8.9.15-r0 |
| minimos | elasticsearch-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-9.5 | 9.5.1-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.20-r0 |
| minimos | elasticsearch-fips-9.4 | 9.4.5-r0 |
| minimos | elasticsearch-fips-9.5 | 9.5.1-r0 |
| minimos | gradle-8 | 8.14.6-r0 |
| minimos | gradle-9 | 9.7.1-r0 |
| minimos | jenkins | 2.577-r0 |
| minimos | jruby-10.0 | 10.0.7.0-r0 |
| minimos | jruby-10.1 | 10.1.1.0-r0 |
| minimos | keycloak | 26.7.5-r0 |
| minimos | keycloak-fips | 26.7.5-r0 |
| minimos | logstash-9.4 | 9.4.8-r0 |
| minimos | logstash-9.5 | 9.5.5-r0 |
| minimos | nexus3 | 3.95.0.07-r0 |
| minimos | nexus3-fips | 3.95.0.07-r0 |
| minimos | opensearch-3 | 3.8.0-r0 |
| minimos | sonarqube | 26.10.0.133078-r0 |
| rapidfort amazon linux 2023 | bouncycastle | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-javadoc | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-mail | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pg | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-pkix | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-tls | 1.70-4.amzn2023.0.8 |
| rapidfort amazon linux 2023 | bouncycastle-util | 1.70-4.amzn2023.0.8 |
| rapidfort debian 12 | bouncycastle | 0:1.86-1 |
| rapidfort debian 13 | bouncycastle | 0:1.86-1 |
| Red Hat | bcpkix-jdk15on | no fix listed |
| Red Hat | bcpkix-jdk18on | no fix listed |
| Red Hat | bcprov-jdk15on | no fix listed |
| Red Hat | candlepin | no fix listed |
| Red Hat | candlepin-selinux | no fix listed |
| Red Hat | ceph | no fix listed |
| Red Hat | ceph-base | no fix listed |
| Red Hat | ceph-common | no fix listed |
| Red Hat | ceph-fuse | no fix listed |
| Red Hat | ceph-immutable-object-cache | no fix listed |
| Red Hat | ceph-mib | no fix listed |
| Red Hat | ceph-resource-agents | no fix listed |
| Red Hat | ceph-selinux | no fix listed |
| Red Hat | cephadm | no fix listed |
| Red Hat | cephfs-top | no fix listed |
| Red Hat | libarrow | no fix listed |
| Red Hat | libarrow-doc | no fix listed |
| Red Hat | libcephfs-devel | no fix listed |
| Red Hat | libcephfs-proxy2 | no fix listed |
| Red Hat | libcephfs2 | no fix listed |
| Red Hat | librados-devel | no fix listed |
| Red Hat | librados2 | no fix listed |
| Red Hat | libradospp-devel | no fix listed |
| Red Hat | libradosstriper1 | no fix listed |
| Red Hat | librbd-devel | no fix listed |
| Red Hat | librbd1 | no fix listed |
| Red Hat | librgw-devel | no fix listed |
| Red Hat | librgw2 | no fix listed |
| Red Hat | parquet-libs | no fix listed |
| Red Hat | python3-ceph-argparse | no fix listed |
| Red Hat | python3-ceph-common | no fix listed |
| Red Hat | python3-cephfs | no fix listed |
| Red Hat | python3-rados | no fix listed |
| Red Hat | python3-rbd | no fix listed |
| Red Hat | python3-rgw | no fix listed |
| Red Hat | rbd-nbd | no fix listed |
| seal maven::Seal Security Database | org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | org.bouncycastle:bcprov-jdk18on | 1.82+sp3p3 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| seal maven::Seal Security Database | seal.sp1p1.org.bouncycastle:bc-fips | 1.0.2.5+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk15to18 | 1.78.1+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.bouncycastle:bcprov-jdk18on | 1.82+sp999 |
| wolfi | apache-pulsar-4.2 | 4.2.4-r5 |
| wolfi | druid | 37.0.0-r57 |
| wolfi | keycloak-26.6 | 26.6.7-r1 |
| wolfi | kserve-modelmesh | 0.12.0-r40 |
| wolfi | logstash-9.4 | 9.4.8-r0 |
| wolfi | opensearch-2 | 2.19.6-r11 |
| wolfi | ruby3.2-bouncy-castle-java | 1.5.0146.1-r9 |
| wolfi | ruby3.3-bouncy-castle-java | 1.5.0146.1-r7 |
| wolfi | ruby3.4-bouncy-castle-java | 1.5.0146.1-r8 |
| wolfi | ruby4.0-bouncy-castle-java | 1.5.0146.1-r5 |
| wolfi | spark-4.0 | 4.0.4-r5 |
| wolfi | zipkin | 3.6.1-r28 |
References
- https://access.redhat.com/security/cve/CVE-2026-8763
- https://advisory.echohq.com/cve/CVE-2026-8763
- https://github.com/advisories/GHSA-9pwp-9qqc-pr26
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
- https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
- https://github.com/bcgit/bc-java/wiki/CVE-2026-8763