CVE-2026-63577 Legion of the Bouncy Castle Inc. CVE debrief

Who should care

Defenders responsible for systems using bc-csharp versions before 2.7.0 should assess exposure and verify certificate validation configurations. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of certificate validation processes

Why it matters

CVE-2026-63577 Improper certificate validation in Bouncy Castle Inc.'s bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get certificates accepted by PKIX path validation whose subject distinguished name, or a directoryName subjectAltName, lies outside the CA's permitted subtrees. Defenders should prioritize verifying exposure of bc-csharp versions before 2.7.0 and assessing the impact of certificate validation on their systems.

• Potential for unauthorized certificate acceptance
• Impact on PKIX path validation
• Need for verification of bc-csharp versions and configurations

Technical summary

The vulnerability in bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get certificates accepted by PKIX path validation whose subject distinguished name, or a directoryName subjectAltName, lies outside the CA's permitted subtrees. This occurs because the check looks for the constraint's first RDN anywhere in the name and compares the remaining RDNs from that position, instead of requiring the constraint to be an initial prefix of the name as RFC 5280 sections 4.2.1.10 and 7.1 require. Defenders should prioritize verifying exposure of bc-csharp versions before 2.7.0 and assessing the impact of certificate validation on their systems

Defensive priority

Defenders should prioritize verifying exposure of bc-csharp versions before 2.7.0 and assessing the impact of certificate validation on their systems.

Recommended defensive actions

• Verify bc-csharp version and upgrade to 2.7.0 or later if necessary
• Assess certificate validation configurations and ensure they align with security best practices
• Review and update certificate issuance and validation processes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in bc-csharp before 2.7.0. Patches are available in commits 606e9153b97a265c70ca8293d21ec859344d7de8 and 75c3c576602886180ed92a63c89419e3bd63b392.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.