Skip to content
Fencer Vulns
high 8.7

CVE-2026-71889 json

PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

published 2026-10-03 36 d ago modified 2026-10-06 33 d ago also EUVD-2026-91990

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its own issuing CA therefore reported isValidCertPath() true with an empty error list, while CertPathValidator.getInstance("PKIX", "BC"), which shares no code with the reviewer, rejected the identical chain against the identical trust anchor. An application using the reviewer to make the trust decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA was never authorised to issue. Both copies now check every certificate in the path including the target, waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Patch / fix

  • Legion of the Bouncy Castle Inc. BC-JAVA 1.86
  • Legion of the Bouncy Castle Inc. BC-LTS-JAVA 2.73.13
  • Legion of the Bouncy Castle Inc. BC-FJA 1.0.13, 2.0.13, 2.1.13
  • bouncycastle Debian 14 1.86-1

debian advisories DEBIAN-CVE-2026-71889

  • bouncycastle SLES for SAP applications 16.0, SLES 16.0 1.86-160000.1.1
  • bouncycastle SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.86-150200.3.41.1

suse advisories SUSE-SU-2026:24461-1SUSE-SU-2026:4797-1

  • bouncycastle openSUSE Leap 16.0 1.86-160000.1.1
  • bouncycastle openSUSE Tumbleweed 1.86-1.1

opensuse advisories openSUSE-SU-2026:22169-1openSUSE-SU-2026:12090-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-71889 updated cvss 7.5

org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing n

  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins Red Hat build of Apache Camel 4 for Quarkus 3 bcpkix-jdk18on Red Hat build of Apache Camel for Spring Boot 4 bcpkix-jdk18on Red Hat Build of Keycloak bcpkix-jdk18on, rhbk/keycloak-rhel9
    affected: workaround, no fix available
  • Red Hat Ceph Storage 9 liborc, liborc2, libarrow, parquet-libs
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform 7 bcpkix-jdk15on, bcpkix-jdk18on, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 bcpkix-jdk18on Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9 Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9, devspaces/jetbrains-ide-rhel9, devspaces/pluginregistry-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 bcpkix-jdk18on
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1792044326
    fixed: vendor fix RHSA-2026:88152
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1792044327
    fixed: vendor fix RHSA-2026:88149
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1792044382
    fixed: vendor fix RHSA-2026:88151
show 14 more
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1792044386
    fixed: vendor fix RHSA-2026:88150
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1792040287
    fixed: vendor fix RHSA-2026:88156
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1792040131
    fixed: vendor fix RHSA-2026:88159
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1792041514
    fixed: vendor fix RHSA-2026:88153
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1792040733
    fixed: vendor fix RHSA-2026:88158
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1792040081
    fixed: vendor fix RHSA-2026:88157
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1792040096
    fixed: vendor fix RHSA-2026:88155
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1792040428
    fixed: vendor fix RHSA-2026:88154
  • Red Hat Build of Apache Camel 3.33.4.redhat bcpkix-jdk18on 1.86.0.redhat-00001
    fixed: vendor fix RHSA-2026:83670
  • Red Hat build of Quarkus 3.27.6.redhat bcpkix-jdk18on 1.86.0.redhat-00001
    fixed: vendor fix RHSA-2026:83082
  • Red Hat build of Quarkus 3.33.4.redhat bcpkix-jdk18on 1.86.0.redhat-00001
    fixed: vendor fix RHSA-2026:83520
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1792044376 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1792044361 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1792044402 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1792044379 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1792040156 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1792040149
    +6 more products
    Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1792041201 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-agent-base-rhel9 1792040114 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-agent-base-rhel9 1792040274 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-agent-base-rhel9 1792039948 Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-agent-base-rhel9 1792040297 Red Hat AMQ Broker 7 bcpkix-jdk18on
    not affected: vulnerable code not present
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-27/de-minimal-rhel9, ansible-automation-platform-27/de-supported-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Build of Apache Camel 3.33.4.redhat jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.4.redhat jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1016 more
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
34 d ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Affected products

  • Legion of the Bouncy Castle Inc. BC-JAVA
  • Legion of the Bouncy Castle Inc. BC-LTS-JAVA
  • Legion of the Bouncy Castle Inc. BC-FJA

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.