CVE-2026-63576: URI name constraints checked against a mis-parsed host

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-28
Weakness: CWE-295

Description

Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.

Affected products

Legion of the Bouncy Castle Inc. bc-csharp: before 2.7.0 — fixed in 2.7.0
Legion of the Bouncy Castle Inc. bc-csharp: before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Legion of the Bouncy Castle Inc. bc-csharp 2.7.0; Legion of the Bouncy Castle Inc. bc-csharp 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-63576 or the next vulnerability affects your stack