CRITICALCVSS 9.1Vulnerability
CVE-2026-8763
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Properties
- severity
- CRITICAL
- cvss_severity
- CRITICAL
- cvss_score
- 9.1
- epss_score
- 0.00451
- retrieved_at
- 2026-09-25T15:12:24+00:00
- last_source
- FIRST EPSS
- score
- 9.1
- cve_id
- CVE-2026-8763
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- published_at
- 2026-08-03T01:16:45.807
- last_modified
- 2026-09-02T14:28:48.940
- epss_percentile
- 0.36573
Related Entities (6)
AFFECTS_PRODUCT (3)
→[Product]
→[Product]
→[Product]
ENRICHED_BY (1)
→[Source]FIRST EPSS
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Improper Certificate Validation
Explore deeper with Ninja Signal's threat intelligence graph