CVE-2026-8763, CVE-2026-13506

Data: 2026-09-18

Severity: Critical

CVSS Score:

• CVE-2026-8763:

  • CVSS v3.1: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

  • CVSS v4.0: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)

• CVE-2026-13506:

  • CVSS v3.1: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

  • CVSS v4.0: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)

Riferimenti:

• CVE-2026-8763 (GHSA-9pwp-9qqc-pr26):

  • https://nvd.nist.gov/vuln/detail/CVE-2026-8763

  • https://github.com/advisories/GHSA-9pwp-9qqc-pr26

  • https://github.com/bcgit/bc-java/wiki/CVE-2026-8763

  • https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558

• CVE-2026-13506 (GHSA-qp49-qgx5-5m26):

  • https://nvd.nist.gov/vuln/detail/CVE-2026-13506

  • https://github.com/advisories/GHSA-qp49-qgx5-5m26

  • https://github.com/bcgit/bc-java/wiki/CVE-2026-13506

  • https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84

Libreria: org.bouncycastle:bcprov-jdk18on (versioni affette: < 1.85)

Descrizione

Entrambe le vulnerabilità riguardano l’elaborazione delle strutture ASN.1 e dei certificati X.509 operata da BouncyCastle, e sono corrette nella medesima release 1.85.

1. [CVE-2026-8763] CWE-295: Improper Certificate Validation

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

2. [CVE-2026-13506] CWE-674: Uncontrolled Recursion

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

GovWay

Versione affette:

• 3.3.x: <= 3.3.20

• 3.4.x: <= 3.4.3

Risoluzione:

• 3.3.x: 3.3.21

• 3.4.x: 3.4.4