bc-csharp: Improper URI name constraint check in certificate path validation
Summary
Bouncy Castle bc-csharp before 2.7.0 extracts the host of URI names in certificates incorrectly during certification path validation. A URI with '@' or ':' in its userinfo, path, query or fragment can make the check compare a different host than the real one, so URI name constraints can be bypassed. An attacker needs a certificate from a name-constrained subordinate CA, or from a CA below it, that carries a crafted URI, so the main threat is a misbehaving or compromised constrained CA. Only applications that rely on URI name constraints to limit trust are affected.
Affected
- bc-csharp (BouncyCastle.Cryptography NuGet package) versions before 2.7.0
- Vendor wiki lists 2.6.2 and earlier, and 2.7.0-beta.98, as affected
- Affects all CLRs
Fixed in
- Upgrade to bc-csharp 2.7.0 or later
Workaround
- No configuration option exists; the fix in 2.7.0 cannot be disabled.
- Until upgrading, applications that depend on URI name constraints can parse each URI name themselves with a standards-compliant parser such as System.Uri, check the host against the constraints, and reject names that do not parse.
- Rejecting URI names containing '@' alone is not sufficient.
- Interim measure: limit which intermediate CAs your applications trust.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public exploit found; not known to be exploited in the wild.
- EPSS score is low (0.00218).
Our recommendation
- Inventory .NET applications that use BouncyCastle.Cryptography and identify their versions.
- Upgrade to 2.7.0 or later, prioritising services that validate certificate chains from partners or internal PKI.
- Until upgrading, review internal CAs with name-constrained intermediates and apply the interim checks above.
- Verify the fix against the vendor wiki before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory (bc-csharp wiki) github.com
- Fix commit f196a22 github.com
- OSV entry CVE-2026-63576 osv.dev
- Vulners CVE-2026-63576 vulners.com
- VulDB CVE-2026-63576 vuldb.com
- OpenCVE CVE-2026-63576 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:30.
Original description (NVD)
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or excluded uniformResourceIdentifier name constraints during certification path validation via a URI whose path, query, fragment or userinfo contains characters such as '@' or ':', because the host was extracted by string slicing without first isolating the RFC 3986 authority component, so the host compared against the constraints could differ from the URI's actual host.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.