Maven/org.bouncycastle:bcprov-jdk18on CVE-2026-8763: critical 9.1, EPSS 0.43%

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

Action: Upgrade org.bouncycastle:bcprov-jdk18on to 1.85 or later.

Affected

Fixed versions

Sources

• osv: GHSA-9pwp-9qqc-pr26#Maven/org.bouncycastle:bcprov-jdk18on
• https://nvd.nist.gov/vuln/detail/CVE-2026-8763
• https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/releases/tag/r1rv85v2
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763
• https://github.com/bcgit/bc-java/wiki/CVE-2026-8763

CVE-2026-8763 · published 2026-08-03T03:31:56Z · modified 2026-09-18T17:45:06.105254943Z · JSON