In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
CVSS Details
- CVSS 4.0 Base Score: 9.3 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Sep 16, 2026 | Sep 15, 2026 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 17 installer 17.67.302 (JDK 17.0.19.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.89.302 (JDK 11.0.31.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.51.302 (JDK 21.0.11.0.201+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.95.0.302 (JDK 8u503-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.35.302 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream) | Sep 16, 2026 | Aug 3, 2026 |
| Redhat_linux | — | — | Aug 19, 2026 | Aug 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub