CVE-2026-63576 (GCVE-0-2026-63576)
Vulnerability from cvelistv5
Published
2026-10-02 07:07
Modified
2026-10-06 19:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-295 - Improper Certificate Validation
Summary
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | bc-csharp |
Version: 0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:21:06.114263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:31:40.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.nuget.org/packages/BouncyCastle.Cryptography",
"defaultStatus": "unaffected",
"packageName": "BouncyCastle.Cryptography",
"product": "bc-csharp",
"programFiles": [
"crypto/src/pkix/PkixNameConstraintValidator.cs",
"crypto/src/pkix/NameConstraintUtilities.cs",
"crypto/src/pkix/NameConstraintUri.cs"
],
"repo": "https://github.com/bcgit/bc-csharp",
"vendor": "Legion of the Bouncy Castle Inc.",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Discovered by Claude, Anthropic\u0027s AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as \u0027@\u0027 or \u0027:\u0027, because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI\u0027s actual host."
}
],
"value": "Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as \u0027@\u0027 or \u0027:\u0027, because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI\u0027s actual host."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Integrity (bypass of permitted/excluded URI name constraints in certification path validation)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:07:02.513Z",
"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"shortName": "bcorg"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63576"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bcgit/bc-csharp/commit/f196a22bbf7765cc19b0c4f4645c74ea7ad35e09"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "URI name constraints checked against a mis-parsed host",
"x_antReportIds": [
"ANT-2026-R05HVR25"
],
"x_generator": {
"engine": "Claude Opus 5.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"assignerShortName": "bcorg",
"cveId": "CVE-2026-63576",
"datePublished": "2026-10-02T07:07:02.513Z",
"dateReserved": "2026-07-16T23:51:51.306Z",
"dateUpdated": "2026-10-06T19:31:40.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"shortName\": \"bcorg\", \"dateUpdated\": \"2026-10-02T07:07:02.513Z\"}, \"title\": \"URI name constraints checked against a mis-parsed host\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\", \"type\": \"CWE\"}]}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Integrity (bypass of permitted/excluded URI name constraints in certification path validation)\"}]}], \"affected\": [{\"vendor\": \"Legion of the Bouncy Castle Inc.\", \"product\": \"bc-csharp\", \"collectionURL\": \"https://www.nuget.org/packages/BouncyCastle.Cryptography\", \"packageName\": \"BouncyCastle.Cryptography\", \"repo\": \"https://github.com/bcgit/bc-csharp\", \"programFiles\": [\"crypto/src/pkix/PkixNameConstraintValidator.cs\", \"crypto/src/pkix/NameConstraintUtilities.cs\", \"crypto/src/pkix/NameConstraintUri.cs\"], \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.7.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as \u0027@\u0027 or \u0027:\u0027, because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI\u0027s actual host.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as \u0027@\u0027 or \u0027:\u0027, because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI\u0027s actual host.\"}]}], \"references\": [{\"url\": \"https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63576\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/bcgit/bc-csharp/commit/f196a22bbf7765cc19b0c4f4645c74ea7ad35e09\", \"tags\": [\"patch\"]}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"HIGH\", \"baseScore\": 8.2, \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\"}}], \"credits\": [{\"lang\": \"en\", \"value\": \"Discovered by Claude, Anthropic\u0027s AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research.\", \"type\": \"finder\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"x_generator\": {\"engine\": \"Claude Opus 5.5\"}, \"x_antReportIds\": [\"ANT-2026-R05HVR25\"]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63576\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-06T19:21:06.114263Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-06T19:21:09.922Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-63576\", \"assignerOrgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"bcorg\", \"dateReserved\": \"2026-07-16T23:51:51.306Z\", \"datePublished\": \"2026-10-02T07:07:02.513Z\", \"dateUpdated\": \"2026-10-06T19:31:40.267Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…