CVE‐2026‐8763

Title: Name Constraints bypass via trailing dot in rfc822Name and URI.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bc-fips 1.0.2.7, 2.0.2 and 2.1.3.

Platform affected: Java 8 and later.

In PKIXNameConstraintValidator, the dNSName path strips trailing dots before comparison, but the rfc822Name (isEmailConstrained) and URI (isURIConstrained) paths compare the extracted host with a bare equalsIgnoreCase. A leaf cert with SAN rfc822Name "ceo@bank.com." therefore does not match an excludedSubtrees entry of "bank.com", so checkExcludedEmail never throws and the path validates. This is reachable from the production PKIXCertPathValidatorSpi_8 → RFC3280CertPathUtilities.processCertBC code path. An attacker who controls a name-constrained intermediate CA can issue certificates for email/URI hosts that the constraints were meant to exclude.

The fix was introduced in commit 2c28b253a446.