Is CVE-2026-103602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103602 being exploited in the wild.

How severe is CVE-2026-103602?

Informational severity, published 2 October 2026.

Which products and versions are affected?

Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0.

Is there a fix for CVE-2026-103602?

Yes: fixed in BouncyCastle.Cryptography 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103602 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103602?

Check whether you run Legion of the Bouncy Castle BouncyCastle.Cryptography at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103602: Bouncy Castle certificate name constraint validation bypass

CVE-2026-103602 · Severity: info · Published 2026-10-02

Bouncy Castle is a cryptographic library used to validate digital certificates in .NET applications. A flaw in the library's validation logic allows an attacker who controls a name-constrained certificate authority to issue unauthorized certificates for email addresses, DNS names, and URIs that should have been rejected, potentially enabling phishing attacks or man-in-the-middle exploitation.

Technologies: Legion of the Bouncy Castle BouncyCastle.Cryptography. Vendors: Legion of the Bouncy Castle.

Quick answers

Is CVE-2026-103602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103602 being exploited in the wild.
How severe is CVE-2026-103602?: Informational severity, published 2 October 2026.
Which products and versions are affected?: Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0.
Is there a fix for CVE-2026-103602?: Yes: fixed in BouncyCastle.Cryptography 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103602 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103602?: Check whether you run Legion of the Bouncy Castle BouncyCastle.Cryptography at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: BouncyCastle.Cryptography 2.7.0

Technical details

The PkixNameConstraintValidator component failed to remove RFC 1034 trailing dots before comparing certificate names against excluded subtrees. This allowed names like "example.com." to bypass restrictions that applied to "example.com", affecting rfc822Name, dNSName, and uniformResourceIdentifier validation. An attacker with a name-constrained intermediate CA certificate could exploit this to issue certificates that pass validation despite violating the CA's constraints.

Affected products

Legion of the Bouncy Castle BouncyCastle.Cryptography before 2.7.0

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.