The vulnerability arises from a trailing dot in the rfc822Name or URI fields of a certificate, allowing an attacker to bypass name constraints enforced by the Bouncy Castle library. This flaw can cause the library to accept certificates that would normally not satisfy the constraints imposed by the certificate path, potentially enabling a man‑in‑the‑middle attack or granting an attacker the ability to impersonate a trusted entity. The weakness is categorized under CWE‑295, indicating an issue in transport layer protection and certificate validation.

Affected are Bouncy Castle for Java releases before version 1.85 and the LTS releases before 2.73.12, as well as Bouncy Castle for Java FIPS (BC‑FJA) versions before bc‑fips 1.0.2.7 for the 1.0.X series, 2.0.2 for the 2.0.X series and 2.1.3 for the 2.1.X series. These include the BC‑FJA, BC‑JAVA, and BC‑LTS‑JAVA product lines under the Legion of the Bouncy Castle Inc. CNA.

The CVSS score of 9.3 signals a critical severity. Because the EPSS score is not available and there is no listing in the CISA KEV catalog, the current exploitation probability is unknown; however, the flaw is activatable with a crafted certificate chain. The likely attack vector involves an attacker deploying a malicious certificate containing a trailing dot in the rfc822Name or URI field, which the unpatched library would incorrectly validate against name constraints. Once validated, the application would accept the certificate, potentially granting the attacker unauthorized network or application level privileges.