Bug 2510201 (CVE-2026-59638)

Summary: CVE-2026-59638 org.bouncycastle/bctls-jdk15on: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Improper hostname validation due to default CN-fallback in JSSE verifier
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bniver, boliveir, bstansbe, cescoffi, dandread, dbruscin, dfreiber, dkreling, dlofthou, drichtar, drow, dschmidt, eglynn, ehelms, ehugonne, ewittman, flucifre, fmariani, fmongiar, gbenhaim, ggainey, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jjoyce, jlanda, jmartisk, jnethert, jpasqual, jpretori, jschluet, juwatts, jwon, kshier, kvanderr, lhh, lthon, manderse, mbenjamin, mburns, mcarlett, mdellweg, mgarciac, mhackett, mhulan, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sdawley, simaishi, smallamp, sostapov, ssilvert, stcannon, sthorger, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Bouncy Castle for Java. The Java Secure Socket Extension (JSSE) hostname verifier incorrectly enables the Common Name (CN) fallback by default, despite it being documented as an opt-in feature. This misconfiguration could allow a remote attacker to bypass proper hostname validation by presenting a specially crafted certificate during a TLS (Transport Layer Security) handshake. As a result, an attacker might be able to impersonate a legitimate server, leading to potential man-in-the-middle attacks and information disclosure.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2533156, 2533157    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-03 02:01:55 UTC
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).