Legion of the Bouncy Castle bc-csharp up to 2.6.x PkixNameConstraintValidator PkixNameConstraintValidator.ExtractHostFromURL certificate validation

Summaryinfo

A vulnerability, which was classified as problematic, was found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. The impacted element is the function PkixNameConstraintValidator.ExtractHostFromURL of the component PkixNameConstraintValidator. Executing a manipulation can lead to certificate validation. This vulnerability is tracked as CVE-2026-63576. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Legion of the Bouncy Castle bc-csharp up to 2.6.x. This vulnerability affects the function PkixNameConstraintValidator.ExtractHostFromURL of the component PkixNameConstraintValidator. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.

The advisory is available at github.com. This vulnerability was named CVE-2026-63576 since 07/17/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

Upgrading to version 2.7.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Legion of the Bouncy Castle

Name

• bc-csharp

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion