CVE-2026-103602
HighCVSS 8.2Summary
Improper certificate validation in PkixNameConstraintValidator in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows an attacker who controls or can obtain certificates from a name-constrained intermediate CA to have certificates accepted for email addresses, DNS names, or URI hosts within excluded subtrees, via names ending with a dot (e.g., rfc822Name, dNSName, uniformResourceIdentifier), because comparison does not remove the trailing root-label dot per RFC 1034.
Risk Assessment
This may lead to bypassing name constraints in PKIX certification path validation, allowing an attacker to use certificates that should be rejected. Consequently, unauthorized access or impersonation may occur.
Recommendation
Update the Bouncy Castle for .NET (bc-csharp) library to version 2.7.0 or later. The new version removes the trailing dot before comparing names and constraints.
Other vulnerabilities in Bouncy Castle (bc-csharp)
See all- CVE-2026-63570High
A vulnerability in the bc-csharp library (Bouncy Castle for .NET) in Pkcs12Store.GetCertificateChain involves a loop with an unreachable exit condition. An attacker can supply a crafted PKCS#12 file where the certificate chain forms a cycle (e.g., two certificates whose AuthorityKeyIdentifier extensions reference each other's public key), causing the application to hang and exhaust memory until an OutOfMemoryException occurs.
- CVE-2026-103604High
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request, or other structure whose name contains a long attribute value requiring escaping (e.g., commas, leading/trailing spaces), causing quadratic growth in processing time.
- CVE-2026-103603High
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count (L), leading to allocation of an array of size L-1 and memory exhaustion (up to ~17 GB) or OutOfMemoryException.
- CVE-2026-103601High
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote attacker to obtain decryptions of chosen ciphertexts via forged messages sent to an application that lets the output buffer of a failed decryption be observed (e.g., through buffer reuse or logging), because decryption writes recovered plaintext into the caller-supplied output buffer before checking the authentication tag and leaves it there on failure.
- CVE-2026-103600High
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via crafted ASN.1 encoding of deeply nested constructed elements (e.g., SEQUENCE inside SEQUENCE), because each nesting level is parsed by a further recursive call with no depth bound. About 2,000 levels (8 KB DER) are enough to exhaust a 1.5 MB thread stack and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process.
Original NVD description (English source)
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation for email addresses, DNS names or URI hosts that lie within excluded subtrees applying to that CA, via an rfc822Name, dNSName or uniformResourceIdentifier name whose host ends with a dot, because names and constraints were compared without first removing the RFC 1034 root-label trailing dot, so a fully qualified host name did not match an excluded subtree for the same host written without the dot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS