CVE-2026-63576 in bc-csharp
Summary
by MITRE • 10/02/2026
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Legion of the Bouncy Castle Inc.'s bc-csharp library prior to version 2.7.0 represents a critical failure in certificate path validation logic, specifically within the PkixNameConstraintValidator component responsible for processing Uniform Resource Identifier constraints. This flaw stems from an improper implementation of host extraction during the parsing of subjectAltName URIs found in X.509 certificates. When validating whether a certificate's URI falls within permitted or excluded name constraints defined by a subordinate Certificate Authority, the library fails to correctly isolate the authority component of the URI according to RFC 3986 standards. Instead of properly parsing the scheme, userinfo, host, port, path, query, and fragment components separately, the implementation relies on naive string slicing operations that do not account for special characters such as '@' or ':' within the URI structure. This architectural oversight allows an attacker who can obtain certificates with chosen subjectAltName URIs from a name-constrained subordinate CA to bypass these constraints entirely.
The technical root cause lies in the misinterpretation of RFC 3986 syntax rules regarding authority components. In standard URI parsing, any '' character indicates the start of userinfo information that precedes the host and port. Similarly, ':' is used to separate the host from the port number. The vulnerable code fails to identify these delimiters before extracting what it assumes to be the hostname for comparison against constraints. Consequently, if a malicious certificate contains a URI where the path, query, fragment, or userinfo section includes an '' symbol followed by text that resembles a valid domain name, the validator may incorrectly extract this substring as the host. For instance, a URI like http://[email protected]/path might be processed such that evil.com is compared against constraints rather than example.com. This discrepancy enables unauthorized access to resources or services that should have been restricted by the CA's policy, effectively nullifying the security boundaries established through name constraints.
From an operational perspective, this vulnerability undermines the trust model of Public Key Infrastructure systems that rely on strict certificate chain validation and domain-specific restrictions. Organizations utilizing bc-csharp for TLS termination, code signing verification, or secure messaging may find their security posture compromised if they accept certificates from subordinate CAs with broad permissions but limited scope via name constraints. An attacker leveraging this flaw could impersonate a trusted service by presenting a certificate that technically satisfies the constraint check due to parsing errors, even though it does not match the intended domain. This leads to potential man-in-the-middle attacks, unauthorized data access, or integrity violations depending on the application context. The impact is particularly severe in environments where automated systems validate certificates without additional manual oversight, as the flaw allows programmatic bypass of security policies that are designed to limit certificate usage to specific domains or subdomains.
This vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-601 URI Redirection to Untrusted Site within a Trusted Context. It also maps to MITRE ATT&CK techniques related to Defense Evasion, specifically those involving the manipulation of trust anchors or certificate validation processes to bypass security controls. To mitigate this risk, organizations must immediately upgrade bc-csharp to version 2.7.0 or later, where the host extraction logic has been corrected to strictly adhere to RFC 3986 specifications by properly isolating the authority component before comparison. Additionally, developers should implement defense-in-depth strategies such as validating certificate chains against multiple trust stores and monitoring for anomalous certificate presentations that deviate from expected domain patterns. Regular security audits of cryptographic libraries and adherence to updated industry standards are essential to prevent similar parsing-based bypasses in future implementations.