CVE-2026-71889

{
  "etk_id": "ETK-2026-439",
  "cve_id": "CVE-2026-71889",
  "display_id": "CVE-2026-71889",
  "ghsa_id": "GHSA-hqqj-v58h-gr7x",
  "euvd_id": "EUVD-2026-91990",
  "status": "published",
  "anchor_state": "anchored",
  "title": "PKIXCertPathReviewer name-constraint validation flaw",
  "summary": "Affected BC-JAVA certificate-path reviewer implementations can approve a chain whose end-entity certificate falls outside an issuing CA's name constraints. An attacker could have an improperly scoped certificate accepted when an application relies on this reviewer to make its trust decision.",
  "mitigation": "Upgrade bcpkix and bcprov to 1.86 or later, bcpkix-lts8on to 2.73.13 or later, and bcpkix-fips to 1.0.13, 2.0.13, or 2.1.13 or later for the applicable release line. Until upgraded, do not use PKIXCertPathReviewer as the trust-decision mechanism; use the PKIX certificate validator instead.",
  "vendor": "Legion of the Bouncy Castle Inc.",
  "product": "BC-JAVA",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.86"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.86"
      ],
      "package_name": "bcpkix",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.86"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.86"
      ],
      "package_name": "bcprov",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.73.0, < 2.73.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.73.13"
      ],
      "package_name": "bcpkix-lts8on",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.4, < 1.0.13",
        ">= 2.0.0, < 2.0.13",
        ">= 2.1.0, < 2.1.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.0.13",
        "2.0.13",
        "2.1.13"
      ],
      "package_name": "bcpkix-fips",
      "purl": null
    }
  ],
  "cwes": [
    295
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
  "epss_score": 0.0017,
  "epss_percentile": 0.0557,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 18.271798,
  "t0_at": "2026-10-03T08:31:01.178000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T11:34:12.415064+00:00",
      "days": 0.12721339194444445,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:31:01.178000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T08:31:01.178000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:31:01.178000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71889"
    }
  }
}