Read the docs
TI-2026-67476 Aliases CVE-2026-71889GHSA-hqqj-v58h-gr7x

PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

Priority MEDIUM 43CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 14 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its own issuing CA therefore reported isValidCertPath() true with an empty error list, while CertPathValidator.getInstance("PKIX", "BC"), which shares no code with the reviewer, rejected the identical chain against the identical trust anchor. An application using the reviewer to make the trust decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA was never authorised to issue. Both copies now check every certificate in the path including the target, waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix Partial BC-JAVA (Legion of the Bouncy Castle Inc.): 1.86BC-LTS-JAVA (Legion of the Bouncy Castle Inc.): 2.73.13+1 more productRed Hat: 14 advisoriesRed Hat: 14 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Legion of the Bouncy Castle Inc.BC-JAVAbefore 1.861.86Patch availableCNA
Legion of the Bouncy Castle Inc.BC-JAVAbefore 1.861.86Patch availableCNA
Legion of the Bouncy Castle Inc.BC-LTS-JAVA2.73.0 to before 2.73.132.73.13Patch availableCNA
Legion of the Bouncy Castle Inc.BC-FJA1.0.4 to before 1.0.13; 2.0.0 to before 2.0.13; 2.1.0 to before 2.1.131.0.13, 2.0.13, 2.1.13Patch availableCNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*——Legion of the Bouncy Castle Inc.

Remediation

  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86
  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86
  • Fix · CNA BC-LTS-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 2.73.13
  • Fix · CNA BC-FJA (Legion of the Bouncy Castle Inc.) Fixed in 1.0.13, 2.0.13, 2.1.13

Red Hat 14 advisories

  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 11 more Red Hat advisories
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:83670 Released 2026-10-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
    • Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Legion of the Bouncy Castle BC-JAVA 1.86

    11 records Highest priority Priority MEDIUM 4 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2026-67477 MLS external commit can remove an arbitrary group memberPriority MEDIUM 43
    • TI-2026-67475 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentPriority MEDIUM 42
    • TI-2026-67472 MLS X.509 credential not bound to the LeafNode signature keyPriority MEDIUM 41
    Show all 11 records →
  • Release ·

    Legion of the Bouncy Castle BC-LTS-JAVA 2.73.13

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-67475 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentPriority MEDIUM 42
    • TI-2026-67480 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity checkPriority LOW 35
    • TI-2026-67471 Native AES packet cipher returns the raw AES key on an aliasPriority LOW 35
    Show all 5 records →
Show 1 more group
  • Release ·

    Legion of the Bouncy Castle BC-FJA 1.0.13, 2.0.13, 2.1.13

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-67475 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentPriority MEDIUM 42
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.4.redhatFixed RHSA-2026:83670
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 21 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-71889
  2. 2026-10-03 Alias added: GHSA-hqqj-v58h-gr7x
  3. 2026-10-04 Priority changed: MEDIUM → LOW
  4. 2026-10-05 CISA SSVC decision points changed
  5. 2026-10-05 Priority changed: LOW → MEDIUM
  6. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  8. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
  9. 2026-10-16 CVSS score added · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  21. 2026-10-30 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +10 · Red Hat
  22. 2026-10-30 CVSS score added · Red Hat
  23. 2026-11-03 Affected versions changed · Red Hat
  24. 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat · Red Hat
  25. 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat

References

Patch 1

Advisory 1

  • TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
  • TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
  • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
  • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
  • TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences