{"id":"CVE-2026-63576","published":"2026-10-02T08:17:02.787","lastModified":"2026-10-06T20:17:28.360","description":"Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bcgit/bc-csharp/commit/f196a22bbf7765cc19b0c4f4645c74ea7ad35e09","tags":[]},{"url":"https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63576","tags":[]}],"exploitRefs":[{"url":"https://github.com/bcgit/bc-csharp/commit/f196a22bbf7765cc19b0c4f4645c74ea7ad35e09","tags":[]},{"url":"https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63576","tags":[]}],"hasPoc":true,"ai":null}