Bouncy Castle #NET Certificate Path Validation Bypass via URI Parsing Flaw (CVE-2026-63576)

CVE-2026-63576 Vulnerability Overview During certificate path validation, incorrectly applies the RFC 5280 specification for CA certificate constraints when checking names. The specification mandates that constraints should apply only to the host part of the URI; however, the validator erroneously splits the entire URI string by fixed characters (such as , , , , , , ). This can lead to matching content outside the host part, thereby bypassing constraints or incorrectly allowing/rejecting certificates. This vulnerability primarily affects applications that rely on Bouncy Castle ( , ) or directly trust CA certificates via . An attacker can exploit the malicious behavior or compromised state of a subordinate CA constrained by such rules by constructing URI names containing special characters to achieve certificate bypass. Affected Scope Affected Platforms: All CLR Affected Versions: BC #.NET 2.6.2 and earlier, as well as 2.7.0-beta.98 pre-release versions Unaffected Versions: BC #.NET 2.7.0 Remediation Fixed Version: BC #.NET 2.7.0 Fix Details: In version 2.7.0, host parsing follows the URI authority structure defined in RFC 3986. The host ends at the first , , or ; userinfo is removed up to the last ; and bracketed IPv6 literals are handled as-is, rejected only if the port is empty. No configuration changes are required, and there are no settings to restore the old behavior. User Advice: Users are advised to upgrade to version 2.7.0. For applications that cannot upgrade immediately, check whether names are valid, and use standard-compliant URI parsers (such as ) to verify that the hostname conforms to constraints in the CA certificate, rejecting names that cannot be parsed. Simply rejecting names containing is insufficient. Remediation Commit GitHub Commit Discovery and Acknowledgments Discoverer: Claude, AI Assistant by Anthropic Verification and Collaboration: Anthropic Security Team collaborated with Anthropic Research for triage

Goal Reached Thanks to every supporter — we hit 100%!

Bouncy Castle #NET Certificate Path Validation Bypass via URI Parsing Flaw (CVE-2026-63576)

More from this source